CVE-2026-110005

Komodo 2.2.0's periphery agent has an OS command injection flaw in its container-management functions. An authenticated low-privileged user who has Execute permission, or Read plus Logs permission, on a managed server can place shell metacharacters in a container name handled by DestroyContainer or SearchContainerLog. The name is inserted without escaping into a command run with sh -c, so arbitrary commands execute as root on the managed host even if the user lacks Komodo's Terminal permission. Only version 2.2.0 is identified as affected. There is no known public proof of concept and no report of exploitation in the wild.

What to do: Limit Execute and Read-plus-Logs permissions on managed servers to fully trusted administrators, since those rights are enough to reach this root command injection. Upgrade Komodo past 2.2.0 as soon as a fixed release is available, and review periphery hosts for unexpected root activity if untrusted users held those permissions.