External risk intelligence

Komodo Periphery Agent Authentication Bypass Leads to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-110631

The vulnerability exists in the Komodo Periphery agent which listens on port 8120. While this service is intended for communication between internal components, it is a network-accessible API service. It is plausibly reachable from the internet in some deployments where infrastructure components are exposed, but the architecture primarily targets internal management of hosts and containers rather than public-facing services.

Authentication Bypass

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability impacts the Periphery agent within Komodo technology, allowing unauthenticated attackers to bypass security controls and execute commands, potentially with root privileges, on managed hosts. The default configuration's failure to properly validate authentication keys creates a significant risk if the Periphery agent is accessible.

Attackers can bypass authentication for command execution.
It affects systems managing hosts and containers.
Assess exposure of the Periphery agent.

Attack Path

How an attacker could exploit the issue

Attackers can bypass authentication on the Periphery agent to gain trusted access, enabling them to issue commands as if they were a core component. This is possible by connecting to port 8120 and presenting any keypair, exploiting a default configuration where empty key lists lead to an open state. Once authenticated, attackers can execute commands, typically with root privileges, on managed hosts.

Unauthenticated network access to port 8120.
Presenting any keypair to the agent.
Remote command execution with root privileges.

Live Threat

Current exploitation, exposure, and threat context

An authentication bypass in the Periphery agent could allow unauthenticated attackers to execute commands on managed hosts, typically as root. This occurs when empty public key and passkey lists are used, causing the service to fail open. Attackers can then present any keypair to issue API requests, including terminal sessions and container operations, to systems listening on port 8120.

System commands and data could be compromised.
Attackers can bypass authentication via default configuration.
Unauthenticated command execution on managed hosts.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Komodo Periphery agent's authentication bypass could expose managed hosts to unauthenticated remote command execution. Infrastructure or platform teams managing this agent are likely responsible for initial identification and risk assessment. The first practical step involves discovering all instances of the Periphery agent, confirming its network accessibility, identifying the asset owner, and then planning remediation based on the criticality of the affected hosts.

Identify Periphery agent instances and reachability.
Confirm asset ownership and business criticality.
Plan remediation or temporary risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Komodo and its Periphery agent?

Komodo is a software platform used for managing hosts and containers. The Periphery agent is a specific component that acts as a bridge, allowing a central management system to send instructions to these individual hosts or containerized environments.

What is the vulnerability in CVE-2026-110631?

This vulnerability is an authentication bypass, specifically categorized as CWE-1188: Insecure Default Initialization of Resource. It happens because the Periphery agent is designed to 'fail open' if its security configuration lists are empty. Instead of blocking connections, the software defaults to allowing them, which essentially turns off the authentication gatekeeper.

How do attackers trigger this vulnerability?

An attacker needs network access to port 8120, where the Periphery agent listens for commands. The bug is triggered when the agent has not been configured with specific public keys. Because the system defaults to trusting any connection when those lists are empty, an attacker can simply generate their own keypair and present it to the agent to gain unauthorized access.

How relevant is this CVE to my infrastructure?

Halo Surface Signal indicates that while the Periphery agent is meant for internal communication, it functions as a network-accessible service on port 8120. If your deployment has these ports exposed to the public internet, the risk is higher. You should assess whether your internal network architecture allows this management port to be reachable from outside your trusted zones.

How should I respond to this threat?

Begin by locating all running instances of the Periphery agent in your environment. Confirm which of these instances are reachable over the network, particularly those exposed beyond your internal management network. Once identified, work with the asset owners to prioritize these systems for configuration updates or network isolation to prevent unauthorized access while a permanent fix is prepared.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.