---
id: CVE-2026-110005
title: >-
  The `periphery` agent's container-management functionality of Komodo version
  2.2.0 contains an OS command injection vulnerability
summary: >-
  The `periphery` agent's container-management functionality of Komodo version
  2.2.0 contains an OS command injection vulnerability. An authenticated
  low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a
  managed server…
severity: none
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T21:17:36.370'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110005'
references:
  - url: 'https://github.com/moghtech/komodo'
    label: cret@cert.org
  - url: 'https://www.kb.cert.org/vuls/id/456950'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
ingestedAt: '2026-10-13T20:53:44.632Z'
---

## Overview

The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.