CVE-2026-29042 Nuclio Shell Runtime Command Injection Leading to Privilege Escalation
Attackers can execute arbitrary commands and escalate privileges by injecting malicious input into the X-Nuclio-Arguments header in Nuclio Shell Runtime.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29042?
CVE-2026-29042 is a high-severity command injection vulnerability in nuclio, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.
Weakness: CWE-75
Which versions are affected by CVE-2026-29042?
3 open source packages ship an affected version, including github.com/nuclio/nuclio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nuclio/nuclio Go | All versions | None |
github.com/nuclio/nuclio Go | All versions | 1.15.20 |
github.com/nuclio/nuclio Go | All versions | 1.15.20 |
Products include Iguazio Nuclio.
How do I fix CVE-2026-29042?
Upgrade github.com/nuclio/nuclio to 1.15.20 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-29042 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29042 exists.
Sources
Also known as GHSA-95fj-3w7g-4r27, GO-2026-4598.