Komodo Periphery: Authentication bypass due to insecure default configuration

Summary

Komodo through version 2.3.3 contains an authentication bypass in the Periphery agent that runs on managed hosts. With the default configuration, the lists of trusted Core public keys and passkeys are empty, and the agent fails open, so any unauthenticated attacker who can reach port 8120 can connect as a trusted Core. The attacker can then issue Periphery API requests, including terminal sessions and container operations, which typically execute commands on the managed host as root.

Affected

• Komodo Periphery agent through version 2.3.3
• Upgraded v1 installations without configured trusted keys or passkeys may also be affected (not confirmed by the vendor)
• Affected only with the default configuration (empty core_public_keys and passkeys)

Fixed in

Unknown. No vendor advisory or fixed version has been confirmed at the time of writing.

Workaround

• Restrict TCP port 8120 to the IP address of the Core server only, using host firewall or network ACLs
• Never expose port 8120 to the internet
• Set core_public_keys explicitly to the public key of the Core and verify that it is not empty on every agent
• Where supported, use Periphery's outbound connection mode, which avoids an inbound listening port

Exploitation

• No known exploitation in the wild; not listed in CISA KEV at the time of writing
• Public proof of concept: not confirmed
• CISA SSVC: exploitation status poc, automatable yes, technical impact total
• No user interaction or authentication required

Our recommendation

• Check immediately whether Periphery agents listen on port 8120 and whether they are reachable from untrusted networks
• Restrict access to port 8120 to the Core server and set core_public_keys explicitly on every agent
• Review managed hosts for unexpected Periphery connections, terminal sessions or key entries
• Monitor the vendor and this tracker for a confirmed fix and update as soon as one is available
• Also update to version 2.3.0 or later to address the related CVE-2026-110005

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Linked page: Komodo router.rs (v1.19.5) github.com
• Linked page: Komodo server.rs (v2.3.3) github.com
• Komodo state.rs (v2.3.3) github.com
• Komodo periphery.config.toml (v2.3.3) github.com
• Komodo issue #1690 github.com
• VulnCheck advisory www.vulncheck.com
• NixOS nixpkgs issue #574403 github.com
• Komodo discussion #1319 (outbound connection mode) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:08.