CVE-2026-110631 Details
Description
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
A vulnerability exists in the Komodo Periphery agent, all versions through 2.3.3, that allows unauthenticated attackers to execute commands on managed hosts with root privileges. This authentication bypass occurs because the default configuration does not require authentication, leaving the Periphery API, including terminal and container operations, exposed. The issue arises from empty core_public_keys and passkeys lists, which fail open by default, allowing any generated keypair to be accepted as valid.
To address this vulnerability, users should configure core_public_keys or passkeys on their Periphery agents and ensure that the Periphery API on port 8120 is not exposed to untrusted networks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://ravindulakmina.pages.dev/advisories/cve-2026-110631-komodo-periphery-fail-open-rce/ | CISA-ADP | |
| https://github.com/moghtech/komodo/blob/v1.19.5/bin/periphery/src/api/router.rs | [email protected] | Source CodeVendor |
| https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/connection/server.rs | [email protected] | Source CodeVendor |
| https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/state.rs#L82-L88 | [email protected] | Source CodeVendor |
| https://github.com/moghtech/komodo/blob/v2.3.3/config/periphery.config.toml | [email protected] | Source CodeVendor |
| https://github.com/moghtech/komodo/issues/1690 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://ravindulakmina.pages.dev/advisories/komodo-periphery-fail-open-rce/ | [email protected] | AdvisoryExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/komodo-through-2.3.3-periphery-agent-unauthenticated-rce-via-default-configuration | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Komodo | >= 2.0.0, <= 2.3.3 (semver) |
CPE
Remediation
| |
| Komodo Periphery | >= 2.0.0, <= 2.3.3 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | CVE Modified | [email protected] |
| Oct 14, 2026 | New CVE Received | [email protected] |