uselagoon Lagoon up to 2.33.1 SSH privileges management

Summaryinfo

A vulnerability was found in uselagoon Lagoon up to 2.33.1. It has been rated as very critical. Affected by this issue is some unknown functionality of the component SSH. The manipulation leads to privileges management. This vulnerability is referenced as CVE-2026-113788. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in uselagoon Lagoon up to 2.33.1. This issue affects an unknown function of the component SSH. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the `ssh` service for: `too many arguments`. The vulnerability was fixed in Lagoon v2.33.2, which is included in the `lagoon/lagoon-core` helm chart v1.62.2. As a workaround, the `ssh` service in Lagoon core can be disabled. The `ssh-portal` service and components are not effected and can continue to be used.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-113788 since 10/20/2026. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/21/2026). MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 2.33.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• uselagoon

Name

• Lagoon

Version

• 2.33.0
• 2.33.1

Website

• Product: https://github.com/uselagoon/lagoon/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion