CVE-2026-110631: Initialization of a Resource with an Insecure Default in moghtech komodo

CVE-2026-110631 describes an authentication bypass vulnerability in moghtech Komodo through version 2.3.3. The Periphery agent fails to enforce authentication properly because empty core_public_keys and passkeys lists default to allowing any connection. This allows unauthenticated attackers who can reach port 8120 to impersonate a trusted Core by presenting arbitrary generated keypairs. Consequently, attackers can issue Periphery API requests, including terminal sessions and container operations, enabling command execution on managed hosts typically with root-level privileges.

The vulnerability enables unauthenticated remote attackers to bypass authentication controls and gain privileged command execution on managed hosts. This can lead to full system compromise, data loss, or disruption of operations. The CVSS 4.0 score of 9.3 reflects critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to port 8120 to trusted networks only and monitor for unauthorized connections. Avoid deploying vulnerable versions in exposed environments.