moghtech Komodo up to 2.3.3 Periphery Agent core_public_keys/passkeys authentication by alternate name

Summaryinfo

A vulnerability was found in moghtech Komodo up to 2.3.3. It has been rated as very critical. Impacted is an unknown function of the component Periphery Agent. This manipulation of the argument core_public_keys/passkeys causes authentication by alternate name. This vulnerability is tracked as CVE-2026-110631. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in moghtech Komodo up to 2.3.3 and classified as very critical. Affected by this vulnerability is an unknown function of the component Periphery Agent. The manipulation of the argument core_public_keys/passkeys with an unknown input leads to a authentication by alternate name vulnerability. The CWE definition for the vulnerability is CWE-289. The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-110631 since 10/14/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/14/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• moghtech

Name

• Komodo

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3

Website

• Product: https://github.com/moghtech/komodo/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion