CVE-2026-113788 in Lagoon
Summary
by MITRE • 10/21/2026
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the `ssh` service for: `too many arguments`. The vulnerability was fixed in Lagoon v2.33.2, which is included in the `lagoon/lagoon-core` helm chart v1.62.2. As a workaround, the `ssh` service in Lagoon core can be disabled. The `ssh-portal` service and components are not effected and can continue to be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
Lagoon serves as an application delivery platform designed for Kubernetes environments, facilitating the deployment and management of complex microservices architectures. Within this ecosystem, version 2.33.1 and earlier releases contain a critical security flaw located within the core ssh service component. This vulnerability stems from improper handling of command-line arguments passed to the underlying shell execution mechanisms. The technical nature of this flaw aligns with CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. By exploiting this weakness, a malicious actor can inject and execute arbitrary operating system commands on the host infrastructure where the Lagoon core services are running.
The operational impact of this vulnerability is severe due to the privileged nature of the components involved. Successful exploitation allows an attacker to achieve remote code execution with the privileges assigned to the ssh service process. In many Kubernetes deployments, these processes run as root or have access to critical system resources and API endpoints. Consequently, an attacker could leverage this access to escalate their permissions to administrative levels, potentially gaining full control over the cluster nodes, accessing sensitive data stored within persistent volumes, or pivoting to other services within the network. This represents a significant breach of confidentiality, integrity, and availability for the entire platform infrastructure.
From a detection perspective, security teams can monitor container logs associated with the ssh service for specific error patterns indicative of exploitation attempts. The presence of log entries containing the phrase too many arguments serves as a strong indicator that an attacker is attempting to exploit this command injection flaw by passing excessive or malformed parameters to trigger unintended shell behavior. This logging artifact provides a valuable signal for intrusion detection systems and security information and event management platforms to identify active attacks against Lagoon deployments prior to patching.
The exploitation of this vulnerability requires the attacker to possess valid credentials for a Lagoon user account, which acts as an initial access prerequisite. While this constraint limits the attack surface compared to unauthenticated vulnerabilities, it does not eliminate the risk entirely, particularly in environments where internal threats or compromised legitimate accounts are concerns. The threat actor would need to authenticate into the platform and then interact with the vulnerable ssh service interface to trigger the command injection. This scenario maps closely to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically within the context of lateral movement or privilege escalation after initial access has been established through compromised credentials.
To mitigate this risk immediately, organizations should disable the ssh service in Lagoon core if it is not strictly required for their operational workflow. This configuration change effectively removes the attack vector by preventing interaction with the vulnerable component. It is important to note that disabling the standard ssh service does not impact the functionality of the ssh-portal service and its associated components, which remain unaffected by this specific vulnerability and can continue to be utilized without security compromise. For long-term remediation, administrators must upgrade Lagoon core to version 2.33.2 or later. This update is available via the lagoon/lagoon-core Helm chart version 1.62.2 and includes code changes that properly sanitize inputs before shell execution, thereby neutralizing the command injection flaw. Regular patching of containerized applications remains a fundamental best practice in maintaining Kubernetes security posture.