CVE-2026-113788

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-113788
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113788.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-113788
Aliases
  • GHSA-f8mw-q232-qjfp
Published
2026-10-21T15:31:24Z
Modified
2026-10-22T02:49:07Z
Severity
  • 9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Lagoon core ssh service vulnerable to remote code execution
Details

Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the ssh service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the ssh service for: too many arguments. The vulnerability was fixed in Lagoon v2.33.2, which is included in the lagoon/lagoon-core helm chart v1.62.2. As a workaround, the ssh service in Lagoon core can be disabled. The ssh-portal service and components are not effected and can continue to be used.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113788.json"
}
References

Affected packages

Git / github.com/uselagoon/lagoon

Affected ranges

Type
GIT
Repo
https://github.com/uselagoon/lagoon
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1e5a04ed0db863645e3dbdc23849e9889c42a222
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.33.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "original_tag":  "v2.33.2",
            "range":  [
                {
                    "fixed":  "1e5a04ed0db863645e3dbdc23849e9889c42a222"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other
list
v0.*
v0.0.0-test
v0.0.0-test2
v0.15.0
v0.15.1
v0.16.0
v0.16.1
v0.17.0
v0.18.0
v0.18.1
v0.18.10
v0.18.11
v0.18.2
v0.18.3
v0.18.4
v0.18.5
v0.18.6
v0.18.7
v0.18.8
v0.18.9
v0.19.0
v0.19.1
v0.19.2
v0.20.0
v0.20.1
v0.21.0
v0.21.1
v0.21.2
v0.21.3
v0.21.4
v0.22.0
v0.22.1
v0.23.0
v0.23.1
v0.23.2
v0.24.0
v0.6.0
v0.7.0
v0.9.0
v0.9.1
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.1.3
v1.1.4
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.6.0
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.8.2
v1.9.0
v2.*
v2.0.0
v2.0.0-alpha.1
v2.0.0-alpha.2
v2.0.0-alpha.3
v2.0.0-alpha.4
v2.0.0-alpha.5
v2.0.0-alpha.6
v2.0.0-alpha.7
v2.0.0-alpha.8
v2.0.0-alpha.9
v2.0.0-rc.1
v2.0.0-rc.2
v2.0.0-rc.3
v2.0.0-rc.4
v2.0.0-rc.5
v2.0.0-rc.6
v2.0.0-rc.7
v2.0.0-rc.8
v2.0.0-rc.9
v2.1.0
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.14.1
v2.14.2
v2.15.0
v2.15.1
v2.15.2
v2.15.3
v2.15.4
v2.16.0
v2.17.0
v2.18.0
v2.18.1
v2.18.2
v2.19.0
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.20.0
v2.20.1
v2.21.0
v2.22.0
v2.23.0
v2.24.0
v2.24.1
v2.25.0
v2.26.0
v2.26.1
v2.27.0
v2.28.0
v2.29.0
v2.29.1
v2.29.2
v2.3.0
v2.30.0
v2.31.0
v2.32.0
v2.33.0
v2.33.1
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.8.0
v2.9.0
v2.9.1
v2.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113788.json"