PT-2026-4632 · Digitalocean · Digitalocean Droplet Agent

Anmol Singh Rajput + 1 · Published 2026-01-24 · Updated 2026-03-27 · CVE-2026-24516

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DigitalOcean Droplet Agent versions through 1.3.2

Description A command injection issue exists due to inadequate input validation when processing metadata from the metadata service endpoint. Specifically, the troubleshooting actioner component does not properly sanitize commands specified in the TroubleshootingAgent.Requesting array after the "command:" prefix. This allows an attacker controlling metadata responses to inject and execute arbitrary OS commands with root privileges. The attack is initiated by sending a crafted TCP packet to the SSH port, causing the agent to retrieve metadata from http://169.254.169.254/metadata/v1.json. The vulnerable code is located in internal/troubleshooting/actioner/actioner.go (insufficient validation), internal/troubleshooting/command/exec.go (direct exec.CommandContext call), and internal/troubleshooting/command/command.go (command parsing without sanitization). This could result in complete system compromise, data exfiltration, and privilege escalation.

Recommendations Versions prior to 1.3.3 should be updated.

Exploit

Fix

Command Injection

Code Injection

Weakness Enumeration

CWE-77

CWE-94

Related Identifiers

CVE-2026-24516

GHSA-FH3M-562M-W4F6

GO-2026-4854

SUSE-SU-2026:1135-1

Affected Products

Digitalocean Droplet Agent

References · 150

• 🔥 https://github.com/poxsky/CVE-2026-24516-DigitalOcean-RCE · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fh3m-562m-w4f6 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24516 · Security Note
• https://github.com/digitalocean/droplet-agent/blob/main/internal/troubleshooting/actioner/actioner.go · Note
• https://github.com/digitalocean/droplet-agent/blob/main/internal/troubleshooting/command/command.go · Note
• https://github.com/digitalocean/droplet-agent/blob/main/internal/troubleshooting/command/exec.go · Note
• https://github.com/digitalocean/droplet-agent · Note
• https://suse.com/security/cve/CVE-2026-4342 · Note
• https://suse.com/security/cve/CVE-2026-33758 · Note
• https://suse.com/security/cve/CVE-2026-25783 · Note
• https://suse.com/security/cve/CVE-2026-33191 · Note
• https://suse.com/security/cve/CVE-2026-32953 · Note
• https://suse.com/security/cve/CVE-2026-33247 · Note