CVE-2026-110631Critical· 9.8▾ AbyssalPoC availableKomodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attack…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Exploit / PoC code exists
0.7% → 0.9%
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110005High· 8.8The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability
CVE-2026-82267Medium· 5.4Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers
CVE-2026-114397High· 7.4Trudesk through 1.2.11 Missing Authentication on Debug Routes
CVE-2026-111764High· 7.5A2A Java SDK has a fail-open default task authorization
CVE-2026-77934High· 8.8Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner
CVE-2026-77936Critical· 9.8Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access