A high-severity authorization bypass vulnerability in Nuclio allows authenticated users to perform unauthorized write and delete operations on serverless projects and their associated infrastructure.

The vulnerability is a missing authorization flaw (CWE-862) within the project management API of the Nuclio Dashboard. Any authenticated user, even those without membership in a target project, can bypass Open Policy Agent (OPA) checks on write and delete paths to manipulate project resources.

The ability for an unauthorized user to modify or delete serverless functions and API gateways poses a significant risk to service availability and operational integrity. Given the CVSS score of 8.3, this flaw enables destructive actions that could lead to widespread system downtime or the loss of critical event-processing logic.

Immediate Action: Upgrade to Nuclio version 1.16.0 or the specified fixed build to resolve the authorization bypass.

Proactive Monitoring: Audit access logs for unauthorized attempts to access or modify project configurations, specifically focusing on PUT and DELETE requests to the /api/projects endpoint.

Compensating Controls: Implement strict network-level access controls to limit access to the Nuclio Dashboard to authorized administrative personnel only, effectively reducing the pool of potential attackers.

Public Exploit Available: No (unknown)

This vulnerability represents a significant risk to the integrity of serverless environments managed by Nuclio. Organizations should prioritize patching to version 1.16.0 immediately, as the flaw allows any logged-in user to potentially disrupt critical production workflows through unauthorized resource deletion.