An unauthenticated attacker can inject shell metacharacters through the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers. The dashboard on the local/Docker platform expands the resourceNamespace parameter unquoted into a /bin/sh -c command, allowing arbitrary command execution inside the dashboard container. This flaw is a classic OS command injection (CWE-78) and is rated CVSS 8.7, indicating a high severity impact on confidentiality, integrity, and availability.

The vulnerability is found in Nuclio, affecting versions earlier than 1.17.4. Users running any of those releases on local or Docker‑based dashboards are at risk.

Because the flaw is unauthenticated and triggered by crafted HTTP headers, an attacker who can reach the dashboard API can exploit it without any prior authentication. The EPSS score is 5%, indicating a moderate likelihood of exploitation, and the lack of a KEV listing does not mitigate the fact that the CVSS score of 8.7 denotes a significant risk. The likely attack vector is local network or any externally exposed dashboard endpoint; once exploited, the attacker gains full control over the host running the dashboard container.