CVE-2026-52832Medium· 4.9▾ TwilightPoC availableNuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 27 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
1 GitHub repo
Last analysed / modified upstream
0.5% → 0.6%
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. This issue has been patched in version 1.16.5.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/nuclio/nuclio < 1.16.5Patched in:
github.com/nuclio/nuclio 1.16.5Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-52833High· 8.0Nuclio is a "Serverless" framework for Real-Time Events and Data Processing
CVE-2026-52831High· 8.0Nuclio is a "Serverless" framework for Real-Time Events and Data Processing
CVE-2021-21972Critical· 9.8The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin
CVE-2019-19781Critical· 9.8An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0
CVE-2020-3187Critical· 9.1A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks an…
CVE-2021-40444High· 8.8Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows