Unrated severityNVD Advisory· Published Feb 24, 2026· Updated Feb 27, 2026
api-gateway-deploy Affected by Exploitable Command Injection via Unprivileged Root Execution
CVE-2026-27208
Description
bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege Escalation. This allows an attacker to execute arbitrary commands with root privileges within the container, potentially leading to a container escape and unauthorized infrastructure modifications. This is fixed in version 1.0.1 by implementing strict input sanitization and secure delimiters in entrypoint.sh, enforcing a non-root user (appuser) in the Dockerfile, and establishing mandatory security quality gates.
Affected products
1- Range: = 1.0.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/bleon-ethical/api-gateway-deploy/releases/tag/Securitymitrex_refsource_MISC
- github.com/bleon-ethical/api-gateway-deploy/security/advisories/GHSA-chh5-w73q-4gmmmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.