CVE-2026-110631

Deferred Deferred - Pending Action

Authentication Bypass in Komodo Periphery Agent

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110631

EUVD

EUVD-2026-101259

Affected Vendors & Products

Vendor	Product	Version / Range
moghtech	komodo	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

Executive Summary

CVE-2026-110631 is an authentication bypass vulnerability in Komodo's Periphery agent (versions 2.0.0 through 2.3.3). When core_public_keys and passkeys lists are empty, the agent fails to enforce authentication, allowing any client to connect by presenting a generated keypair. This occurs because the Noise handshake accepts any public key when the authorized-key list is empty. Attackers can exploit this to access the host-management API on port 8120 and execute commands with root privileges.

Detection Guidance

Check if Komodo Periphery agent is running on port 8120 without authentication. Use netstat or ss to verify open ports: netstat -tulnp | grep 8120 or ss -tulnp | grep 8120. Inspect the periphery.config.toml file for empty core_public_keys and passkeys lists. Look for unauthorized terminal sessions or container operations in logs.

Impact Analysis

This vulnerability allows unauthenticated attackers to gain full control over managed hosts via the Periphery agent. Attackers can execute arbitrary commands as root, manage containers, build images, and open terminal sessions. Since the fail-open state is not clearly indicated, users may unknowingly expose their systems to remote code execution (RCE) attacks.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and system integrity. GDPR requires secure processing and access controls for personal data, while HIPAA mandates strict authentication for systems handling protected health information. The lack of authentication bypasses these controls, potentially leading to unauthorized access and data breaches.

Mitigation Strategies

Upgrade Komodo to a version beyond 2.3.3 if available. Configure non-empty core_public_keys and passkeys in periphery.config.toml. Restrict port 8120 to trusted IPs or bind it to localhost. Stop the Periphery agent if not needed. Monitor for unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-110631. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70