Critical severity9.8NVD Advisory· Published Oct 14, 2026· Updated Oct 14, 2026
CVE-2026-110631
CVE-2026-110631
Description
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
Affected products
2Patches
Vulnerability mechanics
References
7- github.com/moghtech/komodo/blob/v1.19.5/bin/periphery/src/api/router.rsnvd
- github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/connection/server.rsnvd
- github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/state.rsnvd
- github.com/moghtech/komodo/blob/v2.3.3/config/periphery.config.tomlnvd
- github.com/moghtech/komodo/issues/1690nvd
- ravindulakmina.pages.dev/advisories/komodo-periphery-fail-open-rce/nvd
- www.vulncheck.com/advisories/komodo-through-2.3.3-periphery-agent-unauthenticated-rce-via-default-configurationnvd
News mentions
0No linked articles in our index yet.