CVE-2026-110005

The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.

• CWE-78

• https://github.com/moghtech/komodo
• https://www.kb.cert.org/vuls/id/456950

Published

Oct 13, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109989The Themify Popup plugin for WordPress is vulnerable to Stor…6.4
• CVE-2026-10999Integer overflow in ANGLE in Google Chrome on Windows prior …6.5
• CVE-2026-109990The Flying Scripts: Delay JavaScript to Improve Site Speed &…7.2
• CVE-2026-109998The Mang Board plugin for WordPress is vulnerable to Stored …7.2
• CVE-2026-11000Use after free in Fonts in Google Chrome on Linux prior to 1…8.8
• CVE-2026-110002The Snazzy Social Media Feed plugin for WordPress is vulnera…9.8
• CVE-2026-11001Inappropriate implementation in Payments in Google Chrome pr…6.5
• CVE-2026-110012The Salon Booking System WordPress plugin before 10.31.3 do…4.3
• CVE-2026-110013The Salon Booking System WordPress plugin before 10.31.9 do…4.8
• CVE-2026-110014The Salon Booking System WordPress plugin before 10.31.9 do…5.3
• CVE-2026-110015The Salon Booking System WordPress plugin before 10.31.9 do…8.8
• CVE-2026-110017The Quick PayPal Payments: Payment Button & Form plugin for …6.4