Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-113788— Lagoon core ssh service vulnerable to remote code execution

Quick assessment

Affected
uselagoon lagoon
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Lagoon 是一个面向 Kubernetes 的应用交付平台。在 2.33.1 之前的版本中，Lagoon 核心组件的 服务存在一个漏洞，攻击者可利用该漏洞执行任意代码，进而可能获得提升的管理权限等。该漏洞的利用前提是攻击者必须拥有一个 Lagoon 用户账户，因此受到一定限制。可通过检查 服务的容器日志中是否出现 来检测是否发生利用。该漏洞已在 Lagoon v2.33.2 中修复，该版本包含在 Helm Chart v1.62.2 中。作为临时缓解措施，可禁用 Lagoon 核心中的 服务。 服务及其相关组件

CVSS 9.4 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-113788

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Lagoon core ssh service vulnerable to remote code execution
Source: CVE Program / CVE List V5
Vulnerability Description
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the `ssh` service for: `too many arguments`. The vulnerability was fixed in Lagoon v2.33.2, which is included in the `lagoon/lagoon-core` helm chart v1.62.2. As a workaround, the `ssh` service in Lagoon core can be disabled. The `ssh-portal` service and components are not effected and can continue to be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
uselagoon lagoon < 2.33.2 -

II. Public POCs for CVE-2026-113788

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-113788

请登录查看更多情报信息。

Other References for CVE-2026-113788 (2)

IV. Related Vulnerabilities

Same weakness: CWE-78

V. Comments for CVE-2026-113788

No comments yet

Leave a comment