PT-2026-21750 · Bleon Ethical · Api-Gateway-Deploy

Bleon-Ethical · Published 2026-02-24 · Updated 2026-03-01 · CVE-2026-27208

Positive Technologies (AI Summary)

CVSS v3.1

9.2

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions bleon-ethical/api-gateway-deploy version 1.0.0

Description The software is susceptible to an attack chain involving OS Command Injection and Privilege Escalation. Successful exploitation allows an attacker to execute arbitrary commands with root privileges within the container, potentially leading to a container escape and unauthorized infrastructure modifications. The issue is related to insufficient input validation and insecure configurations.

Recommendations Update to version 1.0.1, which includes fixes such as strict input sanitization and secure delimiters in the entrypoint.sh file, enforcement of a non-root user (appuser) in the Dockerfile, and mandatory security quality gates.

Exploit

Fix

LPE

Argument Injection

OS Command Injection

Improper Privilege Management

Weakness Enumeration

CWE-88

CWE-78

CWE-250

CWE-269

Related Identifiers

CVE-2026-27208

GHSA-CHH5-W73Q-4GMM

Affected Products

Api-Gateway-Deploy

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27208.json · Exploit
• https://github.com/bleon-ethical/api-gateway-deploy/security/advisories/GHSA-chh5-w73q-4gmm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27208 · Security Note
• https://twitter.com/CVEnew/status/2026298466134089770 · Twitter Post
• https://github.com/bleon-ethical/api-gateway-deploy/releases/tag/Security · Note
• https://twitter.com/CveFindCom/status/2026321720412393951 · Twitter Post
• https://twitter.com/TheHackerWire/status/2026325462319054919 · Twitter Post
• https://twitter.com/cracbot/status/2028062885914800130 · Twitter Post
• https://twitter.com/CveTodo/status/2026320864317239757 · Twitter Post