The flaw is a remote code execution vulnerability in the ssh service of Lagoon core. An attacker can submit specially crafted arguments that allow arbitrary code to run with the permissions of the Lagoon user account. Because the runtime can be elevated to administrative levels, exploitation can compromise the entire platform. Detection may be noticed through the container logs of the ssh service, where the message "too many arguments" appears when an exploit attempt occurs.

Lagoon platform versions prior to 2.33.1 are affected. The vulnerability resides in the core component of Lagoon; other components such as ssh-portal are not impacted. The fix is included in Lagoon v2.33.2, which is shipped with the lagoon/lagoon-core helm chart v1.62.2.

The CVSS score of 9.4 indicates critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no public exploits have been observed yet. An attacker must have a Lagoon user account to succeed, which implies that privilege escalation within the platform is the primary attack vector. However, once an account is compromised or created maliciously, the attacker could potentially gain elevated administrative rights.