CVE-2026-110631 Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
Unauthenticated attackers can bypass authentication in Komodo Periphery Agent to execute commands as root on managed hosts due to insecure default configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110631?
CVE-2026-110631 is a critical authentication bypass vulnerability in moghtech komodo, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
Weakness: CWE-1188
Which versions are affected by CVE-2026-110631?
How do I fix CVE-2026-110631?
No fix has been published for CVE-2026-110631 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-110631 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-110631 exists.
Sources
Also known as GHSA-6388-9x82-rf3x.