Arbitrary Code Execution in Lagoon for Kubernetes by Uselagoon
CVE-2026-113788

9.4CRITICAL

Key Information:

Vendor

Uselagoon

Status
Lagoon
Vendor
CVE Published:
21 October 2026

What is CVE-2026-113788?

Lagoon, an application delivery platform for Kubernetes, contains a vulnerability in its ssh service that allows attackers to execute arbitrary code. This poses significant risks, including the potential for elevated administrative permissions. It is important to note that an attacker would require a valid Lagoon user account to exploit this vulnerability. Effective mitigation includes upgrading to Lagoon version 2.33.2, which addresses the issue, or disabling the ssh service as a workaround. The ssh-portal service remains unaffected and can be used safely. Monitoring container logs for anomalies such as 'too many arguments' can help in detecting attempts to exploit this vulnerability.

Affected Version(s)

lagoon < 2.33.2

References

https://github.com/uselagoon/lagoon/security/advisories/G...
x_refsource_CONFIRM
https://github.com/uselagoon/lagoon/releases/tag/v2.33.2
x_refsource_MISC

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.