VU#456950: Komodo Periphery Agent Contains an OS Command Injection Vulnerability

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-10-13 19:24 UTC
Importiert: 2026-10-20 19:12 UTC
Quelle-ID: certcc_vuln
uid_hash: 43374a59bfa4a602fa1d515fd14a3bcc10ea4d2e0d1ae7c89d400c5b17194d18

CERT/CC Vulnerability Notes

Inhalt

Overview

Versions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execute arbitrary commands as root on the underlying host, enabling persistent compromise of infrastructure.

Description

Komodo is an open-source server and deployment manager, maintained by mogh.tech, widely used in self-hosted and Docker multi-server environments. Periphery is an agent service installed on servers to give Komodo control over Docker environments.

In vulnerable versions of Komodo, Periphery does not properly validate user-supplied Docker container names before those values are interpolated into shell commands used by the agent. Two operations exhibit this vulnerability: container destruction (DestroyContainer / RemoveContainer) and container log searches (SearchContainerLog / GetContainerLogSearch). Through both avenues, raw container names are directly inserted into sh -c command lines without any shell escaping or validation. These commands then run with Periphery's root privileges on the host OS and Docker socket.

Impact

An authenticated non-admin user can escalate privileges through OS command injection via a maliciously crafted container name. Successful exploitation enables arbitrary command execution as root on a target server within a Komodo deployment. Ultimately, this enables an attacker to establish persistence, achieve lateral movement, and completely compromise a user or organization's managed infrastructure.

Solution

Fortunately, Komodo was reached to coordinate this vulnerability, and a patch has been implemented to remediate the issue in versions 2.3.0 and higher. The CERT/CC recommends that all users update immediately.

Acknowledgements

Thanks to Muhammadjon Ahmadjonov for reporting this vulnerability. This document was written by Alex Lewis.

Vendor Information

    One or more vendors are listed for this advisory. Please reference the full report for more information.

References

https://github.com/moghtech/komodo

Other Information

CVE IDs:

CVE-2026-110005

Date Public:

2026-10-13

Date First Published: 2026-10-13

Date Last Updated: 2026-10-13 19:24 UTC

Document Revision: 1

About vulnerability notes

Provide a vendor statement

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-110005							2026-10-13

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
CERT/CC Vulnerability Notes	certcc_vuln	threat_intel		-	de	https://www.kb.cert.org/vuls/atomfeed/

Zurueck zur Eintrags-Liste