{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/456950#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nVersions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execute arbitrary commands as **root** on the underlying host, enabling persistent compromise of infrastructure. \r\n\r\n### Description\r\nKomodo is an open-source server and deployment manager, maintained by mogh.tech, widely used in self-hosted and Docker multi-server environments. Periphery is an agent service installed on servers to give Komodo control over Docker environments. \r\n\r\nIn vulnerable versions of Komodo, Periphery does not properly validate user-supplied Docker container names before those values are interpolated into shell commands used by the agent. Two operations exhibit this vulnerability: container destruction (`DestroyContainer` / `RemoveContainer`) and container log searches (`SearchContainerLog` / `GetContainerLogSearch`). Through both avenues, raw container names are directly inserted into `sh -c` command lines without any shell escaping or validation. These commands then run with Periphery's **root** privileges on the host OS and Docker socket. \r\n\r\n### Impact\r\nAn authenticated non-admin user can escalate privileges through OS command injection via a maliciously crafted container name. Successful exploitation enables arbitrary command execution as **root** on a target server within a Komodo deployment. Ultimately, this enables an attacker to establish persistence, achieve lateral movement, and completely compromise a user or organization's managed infrastructure. \r\n\r\n### Solution\r\nFortunately, Komodo was reached to coordinate this vulnerability, and a patch has been implemented to remediate the issue in versions 2.3.0 and higher. The CERT/CC recommends that all users update immediately.\r\n\r\n### Acknowledgements\r\nThanks to Muhammadjon Ahmadjonov for reporting this vulnerability. This document was written by Alex Lewis.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"},{"category":"other","text":"## Who this affects \r\n\r\nOnly Komodo installations with more than one user, where non-admin users hold restricted permissions. This is a privilege escalation within Komodo's permission model — it is not remotely exploitable without an account, and it grants an admin nothing they do not already have. If your installation has only admin users, you are not affected.\r\n\r\n## Summary\r\n\r\nSeveral Komodo Periphery handlers interpolated request-supplied values into shell command strings executed via bash -c without escaping them. An authenticated user with a Logs grant on a resource could inject shell metacharacters and execute arbitrary commands on the server hosting it.\r\n\r\n## Affected methods\r\n\r\nLog search: SearchContainerLog, SearchStackLog, and the Swarm service equivalent require PermissionLevel::Read plus the Logs specific permission on a Server, Stack, or Deployment. Both the container/service name and the search terms were interpolated into a docker logs … | grep … pipeline. The terms sat inside hand-written single quotes, so a term containing ' escaped its quoting and ran as a separate command.\r\n\r\nRunStackService: Requires PermissionLevel::Execute on a Stack. The ad-hoc supplied service, workdir, user, entrypoint, and env were interpolated into docker compose run (only command was escaped).\r\n\r\nSwarm secret/config creation left name, driver, and labels unescaped and passed the payload through a <<'EOF' heredoc, so a payload containing a line of exactly EOF closed it early and executed the following lines. Handlers on the non-shell execution path could not execute commands, but a name beginning with - was still parsed as a flag by docker.\r\n\r\n## Impact\r\n\r\nArbitrary command execution as the Periphery process user on the target server, bypassing the Komodo permission model.\r\n\r\nExploitation requires an account holding one of the grants above. An account with no relevant grant, or an unauthenticated attacker, cannot reach these endpoints — unless a Periphery instance is exposed directly without its passkey.\r\n\r\n## Affected versions\r\n\r\nAll versions prior to 2.3.0. Verified vulnerable at v1.19.1, v2.0.0, v2.1.0, v2.1.1, v2.1.2, and v2.2.0. The log search vector dates to the introduction of Stack support; RunStackService was introduced in v1.19.1.\r\n\r\n## Patches\r\n\r\nFixed in 2.3.0: request-supplied values are shell-escaped, the heredoc is replaced with a pipe, and -- precedes positional arguments to block argument injection.\r\n\r\nConfiguration fields documented to accept shell syntax (deployment command/extra_args, pre_deploy/post_deploy, on_clone/on_pull, compose_cmd_wrapper) are still passed to a shell by design; setting them requires write permission, which already implies command execution.\r\n\r\n## Workarounds\r\n\r\nNone. Auditing who holds Logs or Execute grants limits exposure but does not remove it. Upgrade to 2.3.0.\r\n\r\n## Classification\r\n\r\nCWE-78: Improper Neutralization of Special Elements used in an OS Command\r\nSecondary: CWE-88 (argument injection)\r\nCVSS 3.1: 9.9 Critical — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","title":"Vendor statment from Komodo"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/456950"},{"url":"https://github.com/moghtech/komodo","summary":"https://github.com/moghtech/komodo"}],"title":"Komodo Periphery Agent Contains an OS Command Injection Vulnerability","tracking":{"current_release_date":"2026-10-13T19:24:09+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.50"}},"id":"VU#456950","initial_release_date":"2026-10-13 19:24:09.627368+00:00","revision_history":[{"date":"2026-10-13T19:24:09+00:00","number":"1.20261013192409.1","summary":"Released on 2026-10-13T19:24:09+00:00"}],"status":"final","version":"1.20261013192409.1"}},"vulnerabilities":[{"title":"The `periphery` agent's container-management functionality of Komodo version 2.","notes":[{"category":"summary","text":"The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution."}],"cve":"CVE-2026-110005","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#456950"}],"product_status":{"known_affected":["CSAFPID-b83129f4-c756-11f1-8fc3-12ffdf7ff0b1"]}}],"product_tree":{"branches":[{"category":"vendor","name":"Komodo","product":{"name":"Komodo Products","product_id":"CSAFPID-b83129f4-c756-11f1-8fc3-12ffdf7ff0b1"}}]}}