https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 17:15:33 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-45730 <p>Nuclio is a &#34;Serverless&#34; framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard&#39;s project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0.</p> <p>Nuclio is a &#34;Serverless&#34; framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard&#39;s project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-45730 https://vulnerability.circl.lu/vuln/ghsa-m8xg-8xg9-mxhm <p><strong>Affected:</strong> Go: github.com/nuclio/nuclio</p> <p>This vulnerability exists in Nuclio Dashboard&#39;s project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (`PUT /api/projects/{id}`, `DELETE /api/projects`) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). CWE classification: CWE-862 (Missing Authorization).</p> <p>---</p> <p>## Summary</p> <p>Nuclio Dashboard correctly enforces OPA-based authorization on the project read path (`GET /api/projects`), populating `MemberIds` in `PermissionOptions` so OPA can filter results by user membership. However, the write paths (`PUT /api/projects/{id}` and `DELETE /api/projects`) construct `PermissionOptions` without setting `MemberIds`. The platform-layer `FilterProjectsByPermissions` function (`pkg/platform/abstract/platform.go:652`) short-circuits when `MemberIds` is empty, bypassing OPA entirely. Any authenticated user who knows a project name can modify or delete that project, triggering cascading deletion of all associated Functions, APIGateways, and FunctionEvents.</p> <p>Affected: Nuclio v1.15.26 (latest Helm release) and HEAD commit e185454 (latest source).</p> <p>---</p> <p>## Attacker Model</p> <p>**Attacker type**: Authenticated low-privilege tenant (no membership in the target project)</p> <p>**Initial access**: - Holds any valid Nuclio Dashboard credentials - The account has no membership in the target project (OPA correctly denies `GET /api/projects`, returning an empty list…</p> <p><strong>Affected:</strong> Go: github.com/nuclio/nuclio</p> <p>This vulnerability exists in Nuclio Dashboard&#39;s project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (`PUT /api/projects/{id}`, `DELETE /api/projects`) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). CWE classification: CWE-862 (Missing Authorization).</p> <p>---</p> <p>## Summary</p> <p>Nuclio Dashboard correctly enforces OPA-based authorization on the project read path (`GET /api/projects`), populating `MemberIds` in `PermissionOptions` so OPA can filter results by user membership. However, the write paths (`PUT /api/projects/{id}` and `DELETE /api/projects`) construct `PermissionOptions` without setting `MemberIds`. The platform-layer `FilterProjectsByPermissions` function (`pkg/platform/abstract/platform.go:652`) short-circuits when `MemberIds` is empty, bypassing OPA entirely. Any authenticated user who knows a project name can modify or delete that project, triggering cascading deletion of all associated Functions, APIGateways, and FunctionEvents.</p> <p>Affected: Nuclio v1.15.26 (latest Helm release) and HEAD commit e185454 (latest source).</p> <p>---</p> <p>## Attacker Model</p> <p>**Attacker type**: Authenticated low-privilege tenant (no membership in the target project)</p> <p>**Initial access**: - Holds any valid Nuclio Dashboard credentials - The account has no membership in the target project (OPA correctly denies `GET /api/projects`, returning an empty list…</p> https://vulnerability.circl.lu/vuln/ghsa-m8xg-8xg9-mxhm