Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, <command>). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4.

CVE-2026-52831 affects Nuclio, a serverless framework for real-time events and data processing. Prior to version 1.16.4, the Nuclio controller constructs a curl invocation string for each cron trigger and stores it as arguments for a Kubernetes CronJob container running under /bin/sh -c. Two fields from the trigger specification, specifically event.headers keys and event.body, are passed into this command string without adequate sanitization. This lack of input validation creates a command injection vulnerability that could allow an attacker to inject arbitrary shell commands into the CronJob execution context. The vulnerability is present in the Kubernetes-based deployment of Nuclio and could have significant impact in cloud-native environments. The issue has been patched in Nuclio version 1.16.4, and users are advised to upgrade immediately.