CVE-2026-110005: Moghtech Komodo contains an OS command injection vulnerability
The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by the DestroyContainer or SearchContainerLog operations. The container name is interpolated without escaping into a command executed using sh -c, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's Terminal permission to obtain unrestricted host-level command execution.
Affected Software
Event History
Frequently Asked Questions
Which Komodo users can exploit this issue?
An authenticated low-privileged user is sufficient if they have Execute permission on a managed server, or both Read and Logs permissions on that server.
Is Terminal permission required for host command execution?
No. The issue allows a user without Komodo Terminal permission to obtain unrestricted command execution on the managed host.
What access does successful exploitation provide?
Commands execute as root on the managed host, giving the attacker unrestricted host-level command execution.
Which actions process the attacker-controlled input?
The affected input is a container name supplied to the DestroyContainer or SearchContainerLog operations.