CVE-2026-45730 in Nuclio
Summary
by MITRE • 09/02/2026
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The Nuclio framework serves as a serverless platform designed for real-time event processing and data handling, relying heavily on role-based access control to secure its multi-tenant architecture. A critical security flaw was identified within the project management API of the Nuclio Dashboard prior version 1.16.0, specifically affecting the authorization logic that governs write operations. This vulnerability stems from a failure in the Object Permission Authorization (OPA) checks when handling HTTP PUT and DELETE requests directed at specific project endpoints. The affected endpoints include /api/projects/{id} for modification tasks and /api/projects for deletion actions. In a properly secured system, these operations should require explicit membership or administrative privileges within the target project to ensure that users can only interact with resources they are authorized to manage.
The technical nature of this flaw constitutes an Authorization Bypass vulnerability, where the application fails to enforce proper access controls on sensitive API endpoints. An authenticated user who is not a member of a specific project could exploit this weakness by sending crafted requests to the aforementioned endpoints. Because the OPA middleware did not correctly validate the relationship between the requesting user and the target resource during write operations, the system would accept these unauthorized commands. This allows an attacker with valid credentials for any account within the Nuclio environment to arbitrarily modify or delete projects that do not belong to them. The scope of impact is severe because a project in Nuclio acts as a container for various serverless resources, including functions and API gateways. Consequently, compromising one project effectively compromises all associated assets contained within it.
The operational impact of this vulnerability extends beyond simple data loss or service disruption. An attacker could use this access to exfiltrate sensitive code logic embedded in the affected functions, disrupt critical real-time data processing pipelines by deleting essential components, or inject malicious serverless functions into other projects if they possess broader permissions that allow resource creation within those targets. This lack of isolation between tenants undermines the fundamental security model of multi-tenant cloud environments. From a classification perspective, this issue aligns with CWE-284 Improper Access Control and is indicative of ATT&CK technique T1078 Valid Accounts, as it leverages legitimate credentials to perform unauthorized actions due to flawed permission enforcement rather than credential theft or privilege escalation through other means.
Mitigation for this vulnerability requires immediate upgrading to Nuclio version 1.16.0 or later, where the authorization checks have been corrected to properly validate user membership against project resources before allowing write operations. Organizations relying on earlier versions should implement compensating controls such as strict network segmentation of the dashboard interface and rigorous monitoring of API access logs for anomalous deletion or modification patterns targeting projects outside expected user boundaries. Additionally, enforcing principle of least privilege by ensuring that users are only granted memberships to necessary projects can limit the blast radius if similar vulnerabilities exist in other parts of the system. Regular security audits focusing on authorization logic across all API endpoints are recommended to prevent recurrence of such access control failures.