CVE-2026-27208 api-gateway-deploy Affected by Exploitable Command Injection via Unprivileged Root Execution
Attackers can execute arbitrary commands with root privileges via OS command injection, leading to container escape and infrastructure compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27208?
CVE-2026-27208 is a critical command injection vulnerability in bleon-ethical api-gateway-deploy, published on 24 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege Escalation. This allows an attacker to execute arbitrary commands with root privileges within the container, potentially leading to a container escape and unauthorized infrastructure modifications. This is fixed in version 1.0.1 by implementing strict input sanitization and secure delimiters in entrypoint.sh, enforcing a non-root user (appuser) in the Dockerfile, and establishing mandatory security quality gates.
Which versions are affected by CVE-2026-27208?
It affects 1 product.
Products include Bleon-Ethical Api-Gateway-Deploy.
How do I fix CVE-2026-27208?
No fix has been published for CVE-2026-27208 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-27208 being exploited?
There is no known exploitation of CVE-2026-27208 in the wild and no public exploit code.