Komodo 2.3.0 Fixes Periphery Root Command Injection
Tech GuruQuick Answer
CERT/CC published VU#456950 for Komodo Periphery agents through 2.2.0 in multi-user deployments. CERT/CC and Komodo describe shell-command construction flaws that can let an authenticated non-admin execute commands as the Periphery process user, commonly root, on a managed server. Match the exact preconditions, follow the record-specific remediation, validate affected workflows, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Komodo servers and Periphery agents, versions, direct exposure, passkey protection, and non-admin grants; upgrade to 2.3.0 or later; test management workflows; and review command, Docker, and host telemetry for misuse.
Last verified: 2026-10-15 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Komodo Periphery agents through 2.2.0 in multi-user deployments |
|---|---|
| Advisory | VU#456950 |
| CVE | CVE-2026-110005 |
| Authoritative release date | 2026-10-13 00:00:00 UTC |
| Authority revision date | 2026-10-13 19:24:00 UTC |
| Affected versions | Komodo Periphery 2.2.0 and earlier where a non-admin account holds the relevant Logs, Execute, or resource grant; unauthenticated access also matters if Periphery is exposed without its passkey. |
| Fixed version | Komodo 2.3.0 or later |
| CVSS base score | 9.9 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CERT/CC and Komodo describe shell-command construction flaws that can let an authenticated non-admin execute commands as the Periphery process user, commonly root, on a managed server.
What To Validate Now
- Inventory. Locate Komodo Periphery agents through 2.2.0 in multi-user deployments deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Komodo Periphery 2.2.0 and earlier where a non-admin account holds the relevant Logs, Execute, or resource grant; unauthenticated access also matters if Periphery is exposed without its passkey. Do not infer applicability from product family or severity alone.
- Remediate. Apply Komodo 2.3.0 or later through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
CERT/CC lists no workaround. The published preconditions do not make the issue unauthenticated by default, but directly exposed Periphery without a passkey changes that boundary. Preserve the authority snapshot, asset and owner records, before-and-after versions, change approval, installation output, validation results, exceptions, and rollback evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
