CERT /CC and mogh[.]tech have disclosed CVE-2026-110005, a critical OS command injection flaw in the Komodo Periphery agent. The advisory assigns a base score of 9.9 (CVSS 3.1) and states that authenticated, low-privileged users can execute root commands on the underlying host. The issue affects installations of Komodo and its Periphery component, with patching required in version 2.3.0.
The report notes that all Komodo and Komodo Periphery releases prior to 2.3.0 are affected, with confirmed vulnerable versions including 1.19.1, 2.0.0, 2.1.0, 2.1.1, 2.1.2 and 2.2.0; there is no public PoC or active exploitation confirmed at the time of the advisory.
The vulnerability stems from improper neutralisation of inputs passed to system shells (CWE-78) and argument injection (CWE-88). Unescaped, user-supplied container names are directly inserted into sh -c command lines during container destruction and log searches.
Additional injection paths exist across handler methods: Read and Logs permissions can be abused to inject single quotes into SearchContainerLog or SearchStackLog queries to escape command quoting, while RunStackService and Swarm secret creation functions pass unescaped parameters to shell pipelines and heredocs. Komodo has patched the issue in version 2.3.0 by escaping request-supplied values, replacing heredocs with pipes, and adding double-dash argument terminators.
CERT/CC recommends updating immediately and auditing accounts granting Logs or Execute permissions; administrators should avoid exposing Periphery instances without a passkey. There is no documented workaround.