CVE-2026-110631: Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty corepublickeys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure non-empty core_public_keys and passkeys lists so the Periphery agent does not accept unauthenticated connections as a trusted Core.
Komodo Periphery Agent core_public_keys and passkeys = non-empty
Event History
Frequently Asked Questions
Which deployments are exposed?
Periphery agents reachable on port 8120 are exposed when both the core_public_keys and passkeys lists are empty. This is the default fail-open configuration described for affected Komodo versions through 2.3.3.
What does an attacker need to exploit this issue?
An attacker needs network reachability to the Periphery agent on port 8120. No valid credentials, prior access, or user interaction is required; the attacker can present an arbitrary generated keypair as a trusted Core.
What access can exploitation provide?
An attacker can issue Periphery API requests, including starting terminal sessions and performing container operations. Commands on managed hosts typically execute as root.
What can be done if patching is not immediately possible?
Restrict network access to port 8120 so untrusted systems cannot reach Periphery agents. Configure non-empty core_public_keys and/or passkeys lists rather than leaving both authentication lists empty.
How can I determine whether an agent is currently at risk?
Check whether the Periphery agent is reachable on port 8120 and inspect its configuration for empty core_public_keys and passkeys lists. An agent meeting both conditions is vulnerable to unauthenticated connections as a trusted Core.