CVE-2026-110005 Details
Description
The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.
A command injection vulnerability has been identified in the 'periphery' agent of Komodo version 2.2.0, allowing authenticated low-privileged users to execute arbitrary commands as root on the managed host. This vulnerability arises from improper validation of user-supplied Docker container names, which are interpolated into shell commands executed with 'sh -c' without escaping. The issue is present in container destruction and log search operations, enabling exploitation by users with 'Execute' or 'Read' plus 'Logs' permissions.
Users are advised to update to Komodo version 2.3.0 or higher, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.kb.cert.org/vuls/id/456950 | CVE | AdvisoryRemedy |
| https://github.com/moghtech/komodo | [email protected] | ProductSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Komodo | <= 2.2.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | CVE Modified | CVE |
| Oct 13, 2026 | New CVE Received | [email protected] |