Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-110631: Komodo lets remote attackers run commands as root
CVE-2026-110631 · published 1 day ago
Summary
Komodo versions up to 2.3.3 have a default setting that lets anyone connect to the Periphery agent on port 8120 without proving they are trusted. Because the list of allowed keys is empty by default, an attacker can send any key and then issue commands that run on the managed servers, often with full administrator rights. Fix the issue by applying the latest Komodo update or changing the configuration to require proper authentication and limit network access to the agent.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| moghtech | komodo | <= 2.3.3 |
Original advisory text
Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
References
- https://github.com/moghtech/komodo/issues/1690 Third Party Advisory
- https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/state.rs#L82-L8... Third Party Advisory
- https://github.com/moghtech/komodo/blob/v1.19.5/bin/periphery/src/api/router.rs Third Party Advisory
- https://www.vulncheck.com/advisories/komodo-through-2.3.3-periphery-agent-unauth... Vendor Advisory
- https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/connection/serv... Third Party Advisory
- https://github.com/moghtech/komodo/blob/v2.3.3/config/periphery.config.toml Third Party Advisory
- https://ravindulakmina.pages.dev/advisories/komodo-periphery-fail-open-rce/ Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1106... Vendor Advisory
- https://github.com/moghtech/komodo Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-110631 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.9
Critical
Type
CWE-1188Initialization of a Resource with an Insecure Default
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta