VU#456950: Komodo Periphery Agent Contains an OS Command Injection Vulnerability
Komodo Periphery before 2.3.0 lets authenticated users inject OS commands via CVE-2026-110005.
CERT/CC reports CVE-2026-110005, an OS command injection flaw in the Komodo Periphery agent affecting every version before 2.3.0. Authenticated users holding Logs or Execute grants could place shell metacharacters into bash command strings used for log search, docker compose run, and Swarm secret or config creation, executing commands as the Periphery process user. The issue is not reachable without an account unless Periphery is exposed without its passkey, and admin-only installations are unaffected. Komodo 2.3.0 escapes request values, replaces the heredoc with a pipe, and blocks argument injection. CVSS 3.1 is 9.9.
- CVE-2026-110005 is authenticated OS command injection scored CVSS 9.9.
- Users with Logs or Execute grants can run commands as the Periphery user.
- Single-admin installations and unauthenticated attackers are not affected.
- Versions before 2.3.0 are vulnerable; 2.3.0 shell-escapes inputs.
- CVEs
- CVE-2026-110005
- Vendors
- Komodo
- Products
- Komodo Periphery
- Organizations
- Komodo
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110005 | OS command injection in Komodo periphery agent 2.2.0 | 8.8 | — |
From the original article
2 min read at kb.cert.orgOverview Versions <= 2. 2. 0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.