CVE-2026-113788: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in uselagoon lagoon
Description
CVE-2026-113788 is a critical OS command injection vulnerability in the ssh service of Lagoon core, an application delivery platform for Kubernetes. Versions prior to 2.33.2 are affected. An attacker with a Lagoon user account could exploit this flaw to execute arbitrary code, potentially gaining elevated administrative permissions. The vulnerability is fixed in Lagoon version 2.33.2. As a workaround, disabling the ssh service in Lagoon core mitigates the risk. The ssh-portal service and other components are not affected. Exploitation attempts may be detected by monitoring container logs for the message 'too many arguments'.
CVSS v4.0
Score 9.4critical
Affected software
uselagoon
lagoon
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Lagoon core versions before 2.33.2 contain an OS command injection vulnerability (CWE-78) in the ssh service. This flaw allows authenticated users to execute arbitrary commands on the system, which could lead to privilege escalation. The vulnerability requires the attacker to have a valid Lagoon user account, limiting exposure. The issue was resolved in Lagoon v2.33.2, included in the lagoon/lagoon-core helm chart v1.62.2. Disabling the ssh service in Lagoon core serves as a temporary mitigation. The ssh-portal service and other components remain unaffected by this vulnerability.
Potential Impact
Successful exploitation allows an attacker with a Lagoon user account to execute arbitrary code on the system, potentially resulting in elevated administrative permissions. This could compromise the integrity and control of the affected Kubernetes application delivery platform.
Mitigation Recommendations
A fixed version is available: Lagoon v2.33.2 resolves this vulnerability. Users should upgrade to this version or later. As a temporary workaround, the ssh service in Lagoon core can be disabled to prevent exploitation. The ssh-portal service and other components are not affected and can continue to be used safely. Monitoring container logs of the ssh service for the message 'too many arguments' may help detect exploitation attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-20T17:39:41.372Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad8de474d27ba8daabd78aa
Added to database: 10/21/2026, 15:46:15 UTC
Last enriched: 10/21/2026, 16:00:20 UTC
Last updated: 10/21/2026, 16:01:16 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.