CVE-2026-52831: Nuclio cron trigger shell command injection leading to RCE

Nuclio's Kubernetes controller generated Kubernetes CronJob containers for cron triggers by concatenating attacker-controlled cron event data into a single shell command and storing it as Args: ["/bin/sh", "-c", curlCommand]. A malicious event.headers key containing an unescaped double quote and shell separators breaks out of the intended curl --header "key: value" quoting and appends arbitrary shell commands. In this run, a real Nuclio controller binary processed a real NuclioFunction Kubernetes custom resource, generated a real Kubernetes CronJob, and a CronJob-derived pod executed attacker-controlled echo and id commands.

• Package/component affected: Nuclio Kubernetes controller, specifically Kubernetes CronJob-based cron trigger generation in pkg/platform/kube/functionres/lazy.go.
• Affected versions: Nuclio versions at or before the vulnerable parent of fixed commit 3356b86a8bfab3f960aa420310ebff765df9dede; the ticket states Nuclio 1.15.27 and earlier are affected.
• Risk level and consequences: Critical. A user who can create or update a Nuclio function with a malicious cron trigger can cause the cluster to create a CronJob whose pod runs arbitrary shell commands in the CronJob container context. This is product-path remote/API-triggered command execution via the Kubernetes/Nuclio API boundary.

Impact Parity

• Disclosed/claimed maximum impact: Code execution / RCE through Nuclio cron trigger event headers or body in Kubernetes CronJob-based cron trigger processing.
• Reproduced impact from this run: Code execution in real Kubernetes CronJob pods generated by the Nuclio controller. The vulnerable pod logs include the attacker marker CVE_PRODUCT_RCE and id output (uid=100(curl_user) ...).
• Parity: full
• Not demonstrated: No attempt was made to chain from CronJob-container command execution to broader cluster privilege escalation. The reproduced impact matches the claimed command execution at the affected product boundary.

Root Cause

In the vulnerable code path, Nuclio decoded cron trigger attributes from a NuclioFunction resource and built a shell command string for invoking the function:

• User-controlled headers were formatted as --header "<headerKey>: <headerValue>" and appended into one string.
• The final curl invocation was embedded in Args: []string{"/bin/sh", "-c", curlCommand} for the CronJob container.
• Because header keys were not escaped for shell context, a key such as X-Exploit"; echo CVE_PRODUCT_RCE; id; echo " terminates the intended quoted header and injects shell commands.
• The vulnerable parent commit used /bin/sh -c; the fixed commit switches to exec-form invocation, Command: []string{"curl"}, passes each curl argument as a separate argv entry, and uses --data-raw for the body so no shell interprets attacker data.

The fixed commit used for negative control is 3356b86a8bfab3f960aa420310ebff765df9dede ([Security] Fix cron trigger shell injection). The reproduction script checks out and builds 3356b86a8bfa^ for the vulnerable path and 3356b86a8bfa for the fixed path, and verifies the relevant patch hunk before running.

Reproduction Steps

1. Use bundle/repro/reproduction_steps.sh.
2. The script:
   • Reuses the prepared Nuclio repository cache when available.
   • Resolves the vulnerable commit as 3356b86a8bfa^ and the fixed commit as 3356b86a8bfa.
   • Builds the real Nuclio cmd/controller binary for both commits.
   • Creates fresh kind Kubernetes clusters for two vulnerable attempts and two fixed attempts.
   • Starts the real Nuclio controller binary inside each kind control-plane container.
   • Applies real NuclioFunction and NuclioProject custom resources.
   • Waits for the controller to generate a Kubernetes CronJob from the malicious cron trigger.
   • Creates a manual Job from that CronJob and captures the real pod logs.
3. Expected evidence:
   • Vulnerable attempts: CronJob JSON contains args[0] == "/bin/sh" and args[1] == "-c", and pod logs contain CVE_PRODUCT_RCE and uid=.
   • Fixed attempts: CronJob JSON contains command: ["curl"], does not contain /bin/sh or -c, and pod logs contain only the stub HTTP response ok with no attacker marker.

Evidence

• bundle/logs/reproduction_steps.log — top-level run log for the final successful run.
• bundle/repro/runtime_manifest.json — structured runtime manifest showing entrypoint_kind="endpoint", service_started=true, healthcheck_passed=true, and target_path_reached=true.
• bundle/logs/vulnerable_attempt1/cronjob_pretty.json and bundle/logs/vulnerable_attempt2/cronjob_pretty.json — vulnerable controller-generated CronJobs. They show the generated container args include /bin/sh, -c, and an injected shell command string containing echo CVE_PRODUCT_RCE; id.
• bundle/logs/vulnerable_attempt1/pod.log and bundle/logs/vulnerable_attempt2/pod.log — real CronJob-derived pod logs. Key excerpt:

CVE_PRODUCT_RCE
uid=100(curl_user) gid=101(curl_group) groups=101(curl_group)

• bundle/logs/fixed_attempt1/cronjob_pretty.json and bundle/logs/fixed_attempt2/cronjob_pretty.json — fixed controller-generated CronJobs. They show command: ["curl"] and discrete args containing the malicious strings as data, not shell syntax.
• bundle/logs/fixed_attempt1/pod.log and bundle/logs/fixed_attempt2/pod.log — fixed negative control pod logs. They contain ok and do not contain CVE_FIXED_SHOULD_NOT_RUN.
• Environment details captured in bundle/logs/reproduction_steps.log include Go, Docker, kind, resolved commits, and built controller binary metadata.

Recommendations / Next Steps

• Keep the fixed exec-form approach: never pass user-controlled cron trigger header keys, header values, or body through /bin/sh -c.
• Pass curl and all arguments as a command/argv vector, not a shell command string.
• Use --data-raw or an equivalent safe body handling mechanism to avoid file expansion or shell substitution primitives.
• Add regression tests that exercise malicious header keys, header values, and bodies through the controller/CronJob generation path and assert no shell is present in the resulting pod spec.
• Upgrade Nuclio deployments to a version containing fixed commit 3356b86a8bfab3f960aa420310ebff765df9dede or later.

Additional Notes

• Idempotency confirmation: bundle/repro/reproduction_steps.sh was run successfully twice consecutively after the final fixes.
• The script uses real Kubernetes objects and a real Nuclio controller binary, but it starts the controller directly in the kind control-plane container rather than installing the full Helm chart. This preserves the relevant production boundary: Kubernetes API/CRD watch -> Nuclio controller reconciliation -> generated Kubernetes CronJob -> real CronJob pod execution.
• A small busybox HTTP stub is deployed only so fixed exec-form curl has a reachable function service target and can complete without retry timeout. It is not used to simulate the vulnerable controller or CronJob generation behavior.