CERT/CC Warns of Critical CVE-2026-110005 OS Command Injection in Komodo Periphery Agent
Do Son 
TL;DR
CERT/CC and maintainers at mogh.tech disclosed CVE-2026-110005, a critical OS command injection flaw in the Komodo Periphery agent. The Komodo Periphery vulnerability carries a CVSS 3.1 base score of 9.9 and lets authenticated low-privileged users run root commands. Administrators must update all deployments to version 2.3.0 immediately.
- CVE: CVE-2026-110005
- CVSS: Awaiting analysis
- Product: Komodo
- Affected: 1.19.1
- Impact: Moghtech Komodo contains an OS command injection vulnerability
- Status: No confirmed exploitation yet
- Patched in: 2.3.0
- Action: Update to 2.3.0 now
Why CVE-2026-110005 Matters for Docker Infrastructure
Self-hosted and multi-server environments use the open-source Komodo platform to manage Docker containers. To control those environments, administrators install the Periphery agent directly on host servers. However, according to the official CERT/CC VU#456950 security advisory, an authenticated non-admin user can bypass the internal permission model. Specifically, the advisory states that “this allows an authenticated attacker to execute arbitrary commands as root on the underlying host, enabling persistent compromise of infrastructure.” Currently, neither CERT/CC nor the vendor has confirmed public proof-of-concept exploit code or active exploitation in the wild.
How the Komodo Periphery Attack Works
Unescaped Container Names and Log Searches
Security researcher Muhammadjon Ahmadjonov reported the flaw, which stems from improper neutralization of special elements in OS commands (CWE-78) and argument injection (CWE-88). Specifically, the Komodo Periphery service fails to validate user-supplied inputs before passing them to system shells. CERT/CC notes that during container destruction and log searches, “raw container names are directly inserted into sh -c command lines without any shell escaping or validation.”
Additional Stack and Swarm Injection Vectors
Furthermore, the vendor statement from Komodo highlights additional injection points across its handler methods. Users holding Read and Logs permissions can inject single quotes into SearchContainerLog or SearchStackLog queries to escape command quoting. Similarly, the RunStackService handler and Swarm secret creation functions pass unescaped parameters to shell pipelines and heredocs.
Affected Versions
Based on both the CERT/CC report and vendor verification, the vulnerability affects multi-user deployments where non-admin accounts hold restricted Execute or Logs grants:
- All Komodo and Komodo Periphery versions prior to 2.3.0.
- Verified vulnerable releases include versions 1.19.1, 2.0.0, 2.1.0, 2.1.1, 2.1.2, and 2.2.0.
Patch and Mitigation Steps
Maintainers patched the Komodo Periphery vulnerability in version 2.3.0 by escaping request-supplied values, replacing heredocs with pipes, and adding double-dash argument terminators. Because the vendor notes that no workarounds exist, “the CERT/CC recommends that all users update immediately.” Meanwhile, administrators should audit user accounts holding Logs or Execute permissions and avoid exposing Periphery instances without a passkey.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
