# Komodo Periphery agent flaw enables root RCE

Published: 2026-10-13 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/5c62990b-6087-5e33-a05a-c189b16855a6/komodo-periphery-agent-flaw-enables-root-rce

> Komodo's Periphery agent (≤2.2.0) lets authenticated non-admin users inject OS commands via container names, gaining root on managed servers.

CERT/CC published VU#456950 describing an OS command injection vulnerability in Periphery, the agent component of the open-source Komodo server/Docker management platform maintained by mogh.tech. Versions 2.2.0 and earlier fail to validate or sanitize user-supplied Docker container names before interpolating them into shell commands executed via sh -c. Two code paths are affected: container destruction (DestroyContainer/RemoveContainer) and container log search (SearchContainerLog/GetContainerLogSearch).

Because Periphery runs with root privileges on the host and has access to the Docker socket, an authenticated non-admin user able to supply or influence a container name can escape the intended command context and execute arbitrary commands as root on the underlying server. This provides a path to full host compromise, persistence, and lateral movement across a Komodo-managed fleet of Docker hosts — effectively a privilege escalation from a low-privileged Komodo account to root on managed infrastructure.

Komodo's maintainers coordinated with the reporter and CERT/CC and have shipped a fix in version 2.3.0. There is no indication in this advisory of in-the-wild exploitation; this is disclosure of a patched vulnerability. Defenders running self-hosted Komodo/Periphery deployments should upgrade to 2.3.0 or later immediately, audit Komodo user permissions (especially non-admin accounts that can trigger container destroy/log-search operations), and review Periphery/host logs for anomalous shell command execution or unexpected container name values containing shell metacharacters.

## Detection guidance (public sample)

### Komodo Periphery Shell Spawn With Metacharacters in Docker Container Command

ATT&CK: T1059

Periphery spawning sh/bash -c with a docker rm/logs command containing shell metacharacters (;, $(, backtick), consistent with container-name command injection (VU#456950). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Komodo Periphery Shell Spawn With Metacharacters in Docker Container Command
id: dd253585-65df-5eb8-b0f4-09d1dadc6cc2
status: experimental
description: Detects the Komodo Periphery agent launching a shell whose docker container
  remove or log command line carries shell metacharacters such as semicolons, command
  substitution or backticks. This matches OS command injection through an unsanitised
  container name (CERT/CC VU#456950, Periphery 2.2.0 and earlier). Legitimate container
  names do not contain these characters.
tags:
- attack.execution
- attack.t1059
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /periphery
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_docker:
    CommandLine|contains:
    - docker rm
    - docker container rm
    - docker logs
    - docker container logs
  selection_meta:
    CommandLine|contains:
    - ;
    - $(
    - '`'
  condition: selection_parent and selection_shell and selection_docker and selection_meta
falsepositives:
- Custom Komodo log-search terms or wrapper scripts that legitimately chain commands
  with a semicolon
level: high
author: Vorant
references:
- https://kb.cert.org/vuls/id/456950
```

### Suspicious Tool Spawned by Shell Running Docker Command With Injected Metacharacters

ATT&CK: T1059

A shell whose command line is a docker command with metacharacters spawns recon, download or reverse-shell tooling, indicating injected commands running as root via Periphery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Tool Spawned by Shell Running Docker Command With Injected Metacharacters
id: f43e3e02-441e-50d8-841c-2882c8e5c01b
status: experimental
description: Detects tools commonly used after command injection (recon, downloaders,
  netcat, scripting interpreters) spawned by an sh/bash parent whose command line
  is a docker command containing shell metacharacters. This is the pattern left when
  a malicious container name breaks out of a docker rm or docker logs invocation,
  as in the Komodo Periphery flaw (VU#456950).
tags:
- attack.execution
- attack.t1059
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /sh
    - /bash
    - /dash
  selection_parentcmd:
    ParentCommandLine|contains: docker
  selection_meta:
    ParentCommandLine|contains:
    - ;
    - $(
    - '`'
  selection_child:
    Image|endswith:
    - /curl
    - /wget
    - /nc
    - /ncat
    - /socat
    - /id
    - /whoami
    - /python
    - /python3
    - /perl
    - /useradd
    - /chmod
  condition: selection_parent and selection_parentcmd and selection_meta and selection_child
falsepositives:
- Administrator maintenance scripts that chain docker commands with curl or chmod
  in a single sh -c string
level: high
author: Vorant
references:
- https://kb.cert.org/vuls/id/456950
```

### Komodo Periphery Spawning Host Namespace Escape Tooling

ATT&CK: T1611

Periphery directly executing nsenter or chroot, or a privileged docker run mounting the host root, suggesting escape to the host or abuse of the Docker socket as root. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Komodo Periphery Spawning Host Namespace Escape Tooling
id: f3e86c7c-f1d8-55d8-a8b9-c876824b4e88
status: experimental
description: Detects the Komodo Periphery agent, which runs as root with Docker socket
  access, launching nsenter or chroot, or starting a privileged docker container with
  the host root filesystem mounted. These are host-escape primitives that fall outside
  normal Periphery container management.
tags:
- attack.privilege-escalation
- attack.t1611
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /periphery
  selection_escape_bin:
    Image|endswith:
    - /nsenter
    - /chroot
  selection_priv_docker:
    CommandLine|contains|all:
    - docker run
    - --privileged
  selection_hostmount:
    CommandLine|contains:
    - ' -v /:/'
    - --volume /:/
    - source=/,
  condition: selection_parent and (selection_escape_bin or (selection_priv_docker
    and selection_hostmount))
falsepositives:
- Administrators deliberately deploying privileged maintenance containers through
  Komodo
level: medium
author: Vorant
references:
- https://kb.cert.org/vuls/id/456950
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/456950

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5c62990b-6087-5e33-a05a-c189b16855a6/komodo-periphery-agent-flaw-enables-root-rce.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup