SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-52832

MEDIUM · CVSS 4.9 EPSS 0.49% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-02 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

Nuclio Dashboard prior to version 1.16.5 is vulnerable due to the default exposure of the POST /api/functions endpoint without authentication, allowing unauthorized access to function configurations. This could lead to unauthorized manipulation or execution of serverless functions, potentially compromising data integrity and application security. Organizations using Nuclio should prioritize upgrading to version 1.16.5 or later to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-52832
Severity
MEDIUM
CVSS
4.9
EPSS
0.49%

Original NVD Description

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. This issue has been patched in version 1.16.5.