{"id":"CVE-2026-110005","title":"The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability","summary":"The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server…","severity":"none","published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T21:17:36.370","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110005","references":[{"url":"https://github.com/moghtech/komodo","label":"cret@cert.org"},{"url":"https://www.kb.cert.org/vuls/id/456950","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"ingestedAt":"2026-10-13T20:53:44.632Z","slug":"CVE-2026-110005","body":"## Overview\n\nThe `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}