Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110631Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration

Critical 9.8

In plain English

A critical-severity security flaw in komodo from moghtech. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.9%top 41.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.

Affected products (as reported)

Vendor	Product	Versions
moghtech	komodo	0 – through 2.3.3

Weakness: CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/moghtech/komodo/issues/1690 issue-tracking
https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/state.rs#L82-L88 technical-description
https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/connection/server.rs technical-description
https://github.com/moghtech/komodo/blob/v2.3.3/config/periphery.config.toml technical-description
https://github.com/moghtech/komodo/blob/v1.19.5/bin/periphery/src/api/router.rs technical-description
https://ravindulakmina.pages.dev/advisories/komodo-periphery-fail-open-rce/ technical-description
VulnCheck Advisory: Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration third-party-advisory
https://ravindulakmina.pages.dev/advisories/cve-2026-110631-komodo-periphery-fail-open-rce/ exploit