CVE-2026-110005
The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS…
- Risk score
- 69/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 2.1%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by the DestroyContainer or …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
References
Original description
The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.
Last activity 13 Oct 2026. Patch Forecast updates every hour.