{"vuid":"VU#456950","idnumber":"456950","name":"Komodo Periphery Agent Contains an OS Command Injection Vulnerability","keywords":null,"overview":"### Overview\r\nVersions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execute arbitrary commands as **root** on the underlying host, enabling persistent compromise of infrastructure. \r\n\r\n### Description\r\nKomodo is an open-source server and deployment manager, maintained by mogh.tech, widely used in self-hosted and Docker multi-server environments. Periphery is an agent service installed on servers to give Komodo control over Docker environments. \r\n\r\nIn vulnerable versions of Komodo, Periphery does not properly validate user-supplied Docker container names before those values are interpolated into shell commands used by the agent. Two operations exhibit this vulnerability: container destruction (`DestroyContainer` / `RemoveContainer`) and container log searches (`SearchContainerLog` / `GetContainerLogSearch`). Through both avenues, raw container names are directly inserted into `sh -c` command lines without any shell escaping or validation. These commands then run with Periphery's **root** privileges on the host OS and Docker socket. \r\n\r\n### Impact\r\nAn authenticated non-admin user can escalate privileges through OS command injection via a maliciously crafted container name. Successful exploitation enables arbitrary command execution as **root** on a target server within a Komodo deployment. Ultimately, this enables an attacker to establish persistence, achieve lateral movement, and completely compromise a user or organization's managed infrastructure. \r\n\r\n### Solution\r\nFortunately, Komodo was reached to coordinate this vulnerability, and a patch has been implemented to remediate the issue in versions 2.3.0 and higher. The CERT/CC recommends that all users update immediately.\r\n\r\n### Acknowledgements\r\nThanks to Muhammadjon Ahmadjonov for reporting this vulnerability. This document was written by Alex Lewis.","clean_desc":null,"impact":null,"resolution":null,"workarounds":null,"sysaffected":null,"thanks":null,"author":null,"public":["https://github.com/moghtech/komodo"],"cveids":["CVE-2026-110005"],"certadvisory":null,"uscerttechnicalalert":null,"datecreated":"2026-10-13T19:24:09.991218Z","publicdate":"2026-10-13T19:24:09.627368Z","datefirstpublished":"2026-10-13T19:24:10.004944Z","dateupdated":"2026-10-13T19:24:09.627365Z","revision":1,"vrda_d1_directreport":null,"vrda_d1_population":null,"vrda_d1_impact":null,"cam_widelyknown":null,"cam_exploitation":null,"cam_internetinfrastructure":null,"cam_population":null,"cam_impact":null,"cam_easeofexploitation":null,"cam_attackeraccessrequired":null,"cam_scorecurrent":null,"cam_scorecurrentwidelyknown":null,"cam_scorecurrentwidelyknownexploited":null,"ipprotocol":null,"cvss_accessvector":null,"cvss_accesscomplexity":null,"cvss_authentication":null,"cvss_confidentialityimpact":null,"cvss_integrityimpact":null,"cvss_availabilityimpact":null,"cvss_exploitablity":null,"cvss_remediationlevel":null,"cvss_reportconfidence":null,"cvss_collateraldamagepotential":null,"cvss_targetdistribution":null,"cvss_securityrequirementscr":null,"cvss_securityrequirementsir":null,"cvss_securityrequirementsar":null,"cvss_basescore":null,"cvss_basevector":null,"cvss_temporalscore":null,"cvss_environmentalscore":null,"cvss_environmentalvector":null,"metric":null,"vulnote":261}