Vulnerability details
CVE-2026-110631
moghtech komodo
Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
CVSS 4.0
9.3Critical
Official description
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| moghtech | komodo | v ≤ 2.3.3 | CVEProject cvelistV5 (CNA) |
References and advisories
8- https://github.com/moghtech/komodo/issues/1690 issue-tracking
- https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/state.rs#L82-L88 technical-description
- https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/connection/server.rs technical-description
- https://github.com/moghtech/komodo/blob/v2.3.3/config/periphery.config.toml technical-description
- https://github.com/moghtech/komodo/blob/v1.19.5/bin/periphery/src/api/router.rs technical-description
- https://ravindulakmina.pages.dev/advisories/komodo-periphery-fail-open-rce/ technical-description
- https://www.vulncheck.com/advisories/komodo-through-2.3.3-periphery-agent-unauthenticated-rce-via-default-configuration third-party-advisory
- https://ravindulakmina.pages.dev/advisories/cve-2026-110631-komodo-periphery-fail-open-rce/ exploit
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-14
- Last updated
- 2026-10-20
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 39 · Medium
Exploit prediction (EPSS)
0.86%
Probability of exploitation in 30 days
58.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-1188Initialization of a Resource with an Insecure Default