External risk intelligence

Lagoon SSH Service Arbitrary Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-113788

The vulnerability exists in the SSH service of an application delivery platform. While SSH services are often network-accessible, this specific service is part of a Kubernetes-based platform's core infrastructure and requires an existing authenticated user account to exploit, making public internet exposure of the vulnerable component less common than a standard public-facing web or gateway service.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Lagoon, an application delivery platform, has a critical vulnerability in its `ssh` service that could allow a logged-in user to execute arbitrary code, potentially leading to elevated administrative permissions. This issue affects Lagoon versions prior to 2.33.2 and has been addressed in subsequent releases.

Users can run unwanted code on the platform.
Allows unauthorized administrative control.
Confirm relevance and check for user account exploitation.

Attack Path

How an attacker could exploit the issue

An attacker with a Lagoon user account could exploit a vulnerability in the SSH service of the Lagoon core to gain elevated administrative permissions. This would involve an attacker interacting with the SSH service through their user account to trigger the vulnerability, potentially allowing them to execute arbitrary code.

Requires an existing Lagoon user account.
Vulnerability triggered via the SSH service.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker with a Lagoon user account could execute arbitrary code through the `ssh` service, potentially leading to elevated administrative permissions within the Lagoon application delivery platform. This risk is mitigated by the requirement for an existing user account and is not present in the `ssh-portal` service.

System administrative control.
Exploitation via authenticated user account.
Compromised platform integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Lagoon Platform team, likely collaborating with Kubernetes Infrastructure and Security Operations, is responsible for addressing this vulnerability. The immediate first step is to identify all Lagoon deployments, confirm their reachability and business criticality, and then assign ownership for remediation planning based on the assessed risk.

Application owners should own the issue.
Verify SSH service reachability and logs.
Plan and coordinate the update or workaround.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Lagoon?

Lagoon is an open-source application delivery platform designed to manage and deploy applications within Kubernetes clusters. It provides the infrastructure necessary to handle containerized environments, serving as a centralized system that orchestrates how code is built, deployed, and maintained across cloud-native environments.

What does CWE-78 mean for CVE-2026-113788?

This CVE involves CWE-78, or OS Command Injection. In plain terms, this means the software incorrectly handles input, allowing an attacker to insert and execute their own system-level commands. Because this happens within the Lagoon core SSH service, an attacker can trick the platform into running unauthorized code, effectively gaining control that should be restricted.

Do I need to worry about unauthenticated internet users?

No. The vulnerability requires the attacker to already possess a valid Lagoon user account to interact with the affected SSH service. If an attacker does not have authorized access to your Lagoon platform, they cannot trigger this specific vulnerability. It is important to note that the separate ssh-portal service is not affected and remains secure from this flaw.

Is my deployment at high risk according to Halo Surface Signal?

Halo Surface Signal labels this as a 'Possible' risk. While the platform's core infrastructure is critical, the requirement for an existing user account makes it less likely to be reached by random internet-based attackers compared to a standard web gateway. However, you should still prioritize reviewing access logs for the 'too many arguments' error.

How do I fix the CVE-2026-113788 vulnerability?

The primary resolution is to update to Lagoon version 2.33.2, which is contained in the lagoon-core helm chart version 1.62.2. If you cannot update immediately, you can implement a workaround by disabling the SSH service in Lagoon core. Begin by auditing your deployments to locate affected versions and ensure team members responsible for infrastructure understand these remediation options.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.