Nuclio Dashboard allows POST /api/functions without authentication in NOP auth mode. The spec.handler field is split only on ':' without path validation, enabling an attacker to specify a file path that escapes the intended module location. Writing arbitrary files in the Dashboard container can lead to deployment of malicious code or modification of critical configuration, potentially giving the attacker full control over the host.

Nuclio version 1.16.4 and earlier are affected. The vulnerability is fixed in Nuclio 1.16.5 and later.

The CVSS score of 4.9 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be non‑authenticated HTTP POST requests to the Dashboard’s /api/functions endpoint, which all users can reach by default. If an attacker can send such a request, they can write arbitrary files to the Dashboard container.