Komodo Log Access Lets Restricted Users Run Commands on Managed Hosts

A restricted user with Komodo Read and Logs permission on a Server, Stack or Deployment can turn an allowed Periphery log search into commands on the managed host, according to CERT/CC’s note and the Komodo statement it carries. The note also names a container-destruction path. Stack Execute permission reaches RunStackService, and the vendor describes affected Swarm secret and configuration operations. Periphery commonly runs with root privileges, so the command can run as root on that host. The issue is CVE-2026-110005; the CVE Program record lists an affected range beginning at 1.19.1, while Komodo calls all versions before 2.3.0 affected. The vendor says admin-only installations are outside this restricted-user escalation path.

Inventory restricted users with Read plus Logs or Stack Execute, then map their resources to the running Periphery versions on each managed server. Upgrade affected agents to 2.3.0 or later and remove unnecessary grants. Review directly exposed Periphery instances for a missing passkey. Where operation and process telemetry exists, correlate affected handler calls with unexpected processes on the host; the vendor says grant review alone is no workaround. Confirm the running version and intended grants after upgrading, and investigate suspicious host activity separately before returning a host to service.