What is the CVSS score of CVE-2026-27208?

CVE-2026-27208 has a CVSS 3.1 base score of 9.2 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of Docker are affected by CVE-2026-27208?

CVE-2026-27208 is a critical vulnerability in API Gateway Deploy v1.0.0 that allows attackers to execute arbitrary operating system commands and escalate privileges, potentially compromising all…

How to fix or mitigate CVE-2026-27208?

Within 24 hours: Inventory all deployments of bleon-ethical/api-gateway-deploy v1.0.0 and isolate affected systems from production networks if operationally feasible. Within 7 days: Implement network segmentation to restrict API gateway access, enable comprehensive logging and monitoring for suspicious command execution patterns, and escalate to the vendor for patch timeline. Within 30 days: Develop a migration plan to an alternative API gateway solution or upgrade to a patched version if released; conduct forensic analysis for signs of exploitation.

Docker CVE-2026-27208

CRITICAL

OS Command Injection (CWE-78)

2026-02-24 security-advisories@github.com

Docker Privilege Escalation Command Injection Api Gateway Deploy

9.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.2 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 24, 2026 - 15:21 nvd

CRITICAL 9.2

DescriptionGitHub Advisory

bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege Escalation. This allows an attacker to execute arbitrary commands with root privileges within the container, potentially leading to a container escape and unauthorized infrastructure modifications. This is fixed in version 1.0.1 by implementing strict input sanitization and secure delimiters in entrypoint.sh, enforcing a non-root user (appuser) in the Dockerfile, and establishing mandatory security quality gates.

AnalysisAI

OS command injection in bleon-ethical/api-gateway-deploy npm package version 1.0.0. Attack chain enables remote code execution through crafted API gateway deployment configuration.