CVE-2026-29042
Published: 06 March 2026
Summary
CVE-2026-29042 is a critical-severity Special Element Injection (CWE-75) vulnerability in Iguazio Nuclio. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates and sanitizes the user-supplied X-Nuclio-Arguments HTTP header before incorporating it into shell commands, preventing command injection exploitation.
Remediates the command injection flaw by applying security patches such as the upgrade to Nuclio version 1.15.20.
Enforces restrictions on the format, length, and content of X-Nuclio-Arguments header inputs to limit opportunities for shell command injection.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote exploitation of a public-facing HTTP endpoint in Nuclio (T1190) to inject and execute arbitrary Unix shell commands (T1059.004), achieving RCE.
NVD Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime…
more
reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.
Deeper analysisAI
CVE-2026-29042 is a command injection vulnerability (CWE-75) in the Nuclio Shell Runtime component of Nuclio, an open-source serverless framework for real-time events and data processing. Affecting versions prior to 1.15.20, the flaw arises when a function is invoked via HTTP, as the runtime reads the user-supplied value from the X-Nuclio-Arguments header and incorporates it directly into shell commands without validation or sanitization. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no privileges or user interaction. By crafting a malicious X-Nuclio-Arguments header in an HTTP request to invoke a Nuclio function, an attacker can inject arbitrary shell commands, potentially achieving remote code execution. This grants high-impact access to confidentiality, integrity, and availability, allowing full system compromise on the hosting environment.
Mitigation is available via upgrading to Nuclio version 1.15.20, where the issue was patched. Relevant advisories and resources include the GitHub security advisory (GHSA-95fj-3w7g-4r27), the patching commit (5352d7e16cf92f4350a2f8d806c4b80b626b5c5a), pull request 4030, and the release notes for version 1.15.20.
Details
- CWE(s)