CVE-2026-110631

Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration

State: Published
Severity: 9.3 Critical
Published: Oct 14, 2026
Updated: Oct 20, 2026
Reserved: Oct 14, 2026

Description

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-1188 Initialization of a Resource with an Insecure Default

Affected Products

Product	Versions
komodomoghtech	2.3.3 and earlierAffected

References

https://github.com/moghtech/komodo/issues/1690issue-tracking
https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/state.rs#L82-L88technical-description
https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/connection/server.rstechnical-description
https://github.com/moghtech/komodo/blob/v2.3.3/config/periphery.config.tomltechnical-description
https://github.com/moghtech/komodo/blob/v1.19.5/bin/periphery/src/api/router.rstechnical-description
https://ravindulakmina.pages.dev/advisories/komodo-periphery-fail-open-rce/technical-description
VulnCheck Advisory: Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configurationthird-party-advisory
https://ravindulakmina.pages.dev/advisories/cve-2026-110631-komodo-periphery-fail-open-rce/exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.