9.8

CVE-2026-110631

CVSS: 9.8v3.1CriticalDeferred
Published 2026-10-14Last modified 2026-10-14
Open JSON

Vulnerability summary

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (cve.org)
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listed0 of 3 catalogs
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 2026-10-14
    PublishedVulnerability first disclosed.
  2. 2026-10-14
    Last modifiedVulnerability information updated.

Description

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.

CVSS metrics

4 scores · 2 sources · 2 versions

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Moghtech1 product
  • komodo≤ 2.3.3

1 vendor · 1 product

References

7 links