CVE-2026-110631 in Komodo
Summary
by MITRE • 10/15/2026
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Komodo versions through 2.3.3 represents a critical authentication bypass within the Periphery agent architecture, fundamentally undermining the security model of the system by allowing unauthenticated access to privileged administrative functions. The core technical flaw stems from the default configuration where both the core_public_keys and passkeys lists are initialized as empty arrays rather than requiring explicit cryptographic validation for incoming connections. This design choice results in a fail-open behavior wherein any client attempting to connect to port 8120 is automatically treated as a trusted Core entity, regardless of whether they possess valid credentials or certificates. By exploiting this misconfiguration, an attacker can generate arbitrary key pairs and present them during the handshake process, successfully authenticating as a legitimate management node without possessing any authorized secrets.
From an operational perspective, the impact of this vulnerability is severe due to the high level of privileges granted to authenticated Core entities within the Periphery framework. Once connected via port 8120 using forged credentials, attackers gain full access to the Periphery API, which serves as the control plane for managing remote hosts and containers. This includes the ability to initiate interactive terminal sessions and execute arbitrary container operations on managed nodes. In most deployment scenarios, these agents operate with root-level privileges or equivalent administrative rights, meaning that successful exploitation allows an attacker to achieve complete command execution on target systems. The attack vector is particularly dangerous because it does not require prior compromise of a management node; instead, it relies solely on network reachability to the exposed service port and basic cryptographic knowledge to generate valid-looking keys for authentication bypass.
This vulnerability aligns with CWE-287, which classifies improper authentication mechanisms that fail to verify identity before granting access, as well as CWE-16, involving configuration errors where default settings are insecure by design. The exploitation technique maps directly to MITRE ATT&CK T1078, specifically the Valid Accounts tactic, where attackers use legitimate credentials or forged identities to maintain persistence and move laterally within a network environment. Furthermore, the ability to execute commands on managed hosts corresponds to T1059 Command and Scripting Interpreter, enabling direct control over endpoint systems for malicious purposes such as data exfiltration, ransomware deployment, or establishing persistent backdoors.
To mitigate this risk, immediate remediation is required by updating Komodo to a version later than 2.3.3 where the default configuration has been corrected to enforce strict authentication requirements. Administrators must ensure that core_public_keys and passkeys are explicitly populated with authorized cryptographic material before deployment in any production environment. Network-level controls should also be implemented, such as restricting access to port 8120 via firewall rules or security groups to only trusted management subnets, thereby reducing the attack surface even if configuration errors occur. Regular audits of default configurations and adherence to secure-by-design principles are essential to prevent similar fail-open vulnerabilities in future deployments.