CVE-2026-52831: Critical Command Injection in Nuclio Cron Trigger Enables Unauthenticated RCE

What's Happening

CVE-2026-52831 is a critical (CVSS 10.0) OS command injection vulnerability (CWE-78) in Nuclio's cron trigger handling. When a CronJob fires a Nuclio function invocation, header and body content from the triggering event are concatenated into a shell command without sanitization. Because Nuclio does not neutralize shell metacharacters in this path, an attacker who can influence the cron-triggered event data can break out of the intended command context and execute arbitrary shell commands inside the function container.

The impact is severe: unauthenticated remote code execution inside Nuclio function containers, with a viable path to further compromise of the underlying Kubernetes node once container-level access is achieved.

Affected Software

• Project: github.com/nuclio/nuclio (Go)
• Affected versions: all releases prior to the fix commit 0.0.0-20260601075854-3356b86a8bfa

Exploitation Status

A public proof-of-concept exists for this vulnerability. No official patch date has been recorded yet in our tracking. Given the CVSS 10.0 score, unauthenticated attack vector, and public PoC availability, defenders should treat this as high-priority — it sits squarely in the window where opportunistic scanning and exploitation attempts are likely before broad patch adoption.

How Our Detection Catches It

We ship coverage across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Chronicle (YARA-L), and CrowdStrike (CQL). The detection logic focuses on three signal categories:

• Injection artifacts in trigger logs: Nuclio dashboard and cron trigger logs are inspected for shell metacharacters (e.g. ;, |, &&, backticks, $()) embedded in event headers or body fields that reach the cron execution path.
• Anomalous child processes: Process telemetry is monitored for unexpected child processes spawned from Nuclio's nuclio-handler or processor binaries — legitimate function execution should not fork shells or unrelated system utilities.
• Kubernetes CronJob shell activity: Suspicious shell invocations launched by Nuclio-managed CronJobs are correlated against expected job behavior to flag deviations consistent with injected commands.

Together, these layers give defenders visibility both at the point of injection (log/event level) and at the point of execution (process/container level), improving the odds of catching exploitation even if one signal is evaded.

Full Detection

For the complete KQL, SPL, and other SIEM queries along with implementation guidance, see the full detection page for CVE-2026-52831.