Attributed metadata history
Up to 100 retained publisher events per page for 24ee6568247fdc9c01a6c0d4722db9d65b7c2d8ddb5fc2f306f49127c44354a2. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_cd638cf167c7c119d6
observed · 2026-10-14 03:25:04 UTC
Overview Versions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execute arbitrary commands as root on the underlying host, enabling persistent compromise of infrastructure. Description Komodo is an open-source server and deployment manager, maintained by mogh.tech, widely used in self-hosted and Docker multi-server environments. Periphery is an agent service installed on servers to give Komodo control over Docker environments. In vulnerable versions of Komodo, Periphery does not properly validate user-supplied Docker container names before those values are interpolated into shell commands used by the agent. Two operations exhibit this vulnerability: container destruction (DestroyContainer / RemoveContainer) and container log searches (SearchContainerLog / GetContainerLogSearch). Through both avenues, raw container names are directly inserted into sh -c command lines without any shell escaping or validation. These commands then run with Periphery's root
Fingerprint: 38127e44ced97a16af10bfadb31401fe014b63be8bba18438c6773cfa6bb2316
intelligence_src_cd638cf167c7c119d6
observed · 2026-10-12 15:23:03 UTC
available
Fingerprint: e9e546feaa1a197f9c3a53bee19e29f6899cd295cb68e67b1de5b309ac3481e8