Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=<value>" command that is executed via the host shell (/bin/sh -c). Because the default auth kind is nop (unauthenticated), a remote attacker can inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket → host compromise. This issue has been patched in version 1.17.4.

CVE-2026-79755 affects Nuclio, a serverless framework for real-time events and data processing, in versions prior to 1.17.4. The vulnerability exists on the Nuclio local Docker platform where the function namespace parameter is interpolated without validation into a shell-executed docker ps command. This allows a remote attacker to inject arbitrary OS commands that execute as root inside the dashboard container. The dashboard container holds the Docker socket, meaning successful exploitation can lead to full host compromise. The vulnerability is made more severe by the default authentication mode being 'nop' (unauthenticated), requiring no credentials for exploitation. This is classified as a critical remote code execution vulnerability with potential for complete host takeover. The issue has been patched in Nuclio version 1.17.4 with a fix committed to the official GitHub repository.