CVE-2026-110005: Komodo Periphery Agent RCE Vulnerability

CVE-2026-110005 Overview

CVE-2026-110005 is an operating system command injection vulnerability in the periphery agent of Komodo version 2.2.0. The agent's container-management functionality interpolates user-supplied container names directly into shell commands executed through sh -c. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters processed by the DestroyContainer or SearchContainerLog operations. The injected commands run as root on the managed host, bypassing Komodo's Terminal permission model.

Critical Impact

Authenticated low-privileged users can achieve unrestricted root-level command execution on managed Komodo hosts without holding Terminal permission.

Affected Products

• Komodo version 2.2.0
• Komodo periphery agent (container-management component)
• Managed server hosts running the periphery agent

Discovery Timeline

• 2026-10-13 - CVE CVE-2026-110005 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-110005

Vulnerability Analysis

The vulnerability resides in two container-management operations exposed by the periphery agent: DestroyContainer and SearchContainerLog. Both operations accept a container name parameter from the Komodo core API. The agent interpolates that name directly into a shell command string and passes the string to sh -c for execution.

Because sh -c performs shell parsing, metacharacters such as ;, |, `, $(), and && are interpreted as shell syntax rather than literal characters. An attacker who controls the container name field can therefore terminate the intended command and append arbitrary shell commands. The agent typically runs with root privileges on the managed host to perform container lifecycle operations, so injected commands execute with root authority.

The permission model fails because Komodo treats container management as distinct from host terminal access. Users granted Execute, or Read combined with Logs, on a managed server can trigger the vulnerable operations without holding the Terminal permission that would normally gate shell access.

Root Cause

The root cause is unsanitized interpolation of attacker-controlled input into a shell command string. Rather than passing the container name as a separate argv element to a non-shell exec call, the code constructs a single shell command string that sh -c subsequently parses. This is a classic [CWE-78] OS command injection pattern.

Attack Vector

The attack vector requires authenticated access to the Komodo API with minimal server-scope permissions. The attacker issues a DestroyContainer or SearchContainerLog request against a server they can read or execute on, supplying a crafted container name containing shell metacharacters. The periphery agent receives the request from the Komodo core, concatenates the name into the shell command, and executes the resulting payload as root. See the CERT Vulnerability Advisory and the Komodo project repository for additional context.

Detection Methods for CVE-2026-110005

Indicators of Compromise

• Unexpected child processes spawned by the periphery agent process, particularly shells, curl, wget, or interpreters such as python, perl, or bash.
• Container names in Komodo audit logs containing shell metacharacters such as ;, |, `, $(, or &&.
• Outbound network connections initiated by the periphery process to unfamiliar hosts.
• New or modified files under /root, /etc, or system binary paths on managed hosts.

Detection Strategies

• Monitor process ancestry on managed hosts for non-container-runtime processes whose parent is the periphery agent.
• Parse Komodo API request logs for container name fields that fail an allowlist of [A-Za-z0-9_.-].
• Alert on DestroyContainer or SearchContainerLog operations issued by accounts that do not routinely perform container lifecycle actions.

Monitoring Recommendations

• Forward periphery agent logs and host process telemetry to a centralized analytics platform for correlation.
• Baseline normal container names and operation frequency per user to surface anomalies.
• Track privilege use on managed hosts, specifically root-owned processes launched outside expected maintenance windows.

How to Mitigate CVE-2026-110005

Immediate Actions Required

• Inventory all hosts running the Komodo periphery agent at version 2.2.0 and isolate internet-exposed instances.
• Revoke Execute, Logs, and broad Read permissions on managed servers for accounts that do not require them.
• Rotate credentials and API keys used to authenticate to the Komodo core, assuming potential prior abuse.
• Review Komodo audit logs for DestroyContainer and SearchContainerLog invocations containing suspicious container name values.

Patch Information

No fixed version is listed in the NVD entry at publication. Monitor the Komodo project repository and the CERT Vulnerability Advisory for updated releases and apply the patched version to every managed host once available.

Workarounds

• Restrict network access to the periphery agent so only the Komodo core can reach it, blocking lateral abuse from compromised accounts.
• Reduce assigned server permissions to the minimum required, removing Execute and Logs from low-trust users until a patch is deployed.
• Run the periphery agent under a non-root service account where feasible, limiting the blast radius of injected commands.
• Enforce strict container naming conventions at the Komodo core layer and reject names containing shell metacharacters.

# Configuration example: restrict periphery agent network exposure
# Allow only the Komodo core host to reach the periphery port
iptables -A INPUT -p tcp --dport 8120 -s <komodo-core-ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 8120 -j DROP