GCVE-110-CERTCC-2026-456950

### Overview Versions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execute arbitrary commands as **root** on the underlying host, enabling persistent compromise of infrastructure. ### Description Komodo is an open-source server and deployment manager, maintained by mogh.tech, widely used in self-hosted and Docker multi-server environments. Periphery is an agent service installed on servers to give Komodo control over Docker environments. In vulnerable versions of Komodo, Periphery does not properly validate user-supplied Docker container names before those values are interpolated into shell commands used by the agent. Two operations exhibit this vulnerability: container destruction (`DestroyContainer` / `RemoveContainer`) and container log searches (`SearchContainerLog` / `GetContainerLogSearch`). Through both avenues, raw container names are directly inserted into `sh -c` command lines without any shell escaping or validation. These commands then run with Periphery's **root** privileges on the host OS and Docker socket. ### Impact An authenticated non-admin user can escalate privileges through OS command injection via a maliciously crafted container name. Successful exploitation enables arbitrary command execution as **root** on a target server within a Komodo deployment. Ultimately, this enables an attacker to establish persistence, achieve lateral movement, and completely compromise a user or organization's managed infrastructure. ### Solution Fortunately, Komodo was reached to coordinate this vulnerability, and a patch has been implemented to remediate the issue in versions 2.3.0 and higher. The CERT/CC recommends that all users update immediately. ### Acknowledgements Thanks to Muhammadjon Ahmadjonov for reporting this vulnerability. This document was written by Alex Lewis.