Description

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T15:17:15.983Z",
  "pubdate": "2026-10-14T15:17:15.983Z",
  "executiveSummary": "Komodo versions through 2.3.3 are affected by a critical authentication bypass vulnerability within the Periphery agent. The vulnerability arises due to an insecure default configuration where empty 'core_public_keys' and 'passkeys' lists are treated as an authorization 'fail-open' state.\nThis flaw permits unauthenticated remote attackers to establish unauthorized connections with the Periphery agent by masquerading as a trusted Core node. By successfully reaching the service exposed on TCP port 8120, an attacker can present an arbitrary, self-generated keypair to satisfy the weak authentication handshake requirements.\nSuccessful exploitation grants the attacker full access to the Periphery API, enabling the execution of sensitive operations including the initiation of interactive terminal sessions and the management of containerized workloads. Given that the Periphery agent typically executes with root privileges on managed hosts, this vulnerability facilitates full system compromise. The attack requires network reachability to the target port, but no valid credentials or pre-existing trust relationships are necessary, rendering the vulnerability highly dangerous for deployments with exposed administrative interfaces.",
  "technicalDetails": "The vulnerability resides in the authentication logic of the Komodo Periphery agent, specifically within the handshake mechanism responsible for verifying the identity of connecting Core controllers. The root cause is an implementation failure in the trust-validation logic: when the 'core_public_keys' or 'passkeys' configuration parameters are left undefined or empty, the application defaults to an open state rather than a closed, secure state.\nThe Periphery agent monitors TCP port 8120 for incoming requests. Under normal operation, a legitimate Core node must present a valid cryptographic credential that matches the authorized keys stored on the Periphery agent. However, due to the fail-open condition, the agent does not properly validate the signature of incoming requests if the internal authorization lists are empty. This allows any arbitrary keypair, generated by an attacker using standard cryptographic tools, to be accepted during the handshake process.\nThe attack flow proceeds as follows: First, the attacker identifies a target host running the Komodo Periphery agent with network accessibility to port 8120. Second, the attacker generates an arbitrary RSA or ECDSA keypair. Third, the attacker initiates a connection to the Periphery API on the target host. When the agent requests authentication, the attacker submits their self-generated public key. Because the agent fails to verify this key against a populated whitelist—or defaults to accepting connections when the whitelist is empty—the handshake is marked as successful by the API server.\nOnce authenticated, the attacker gains full access to the Periphery API functionality. The API allows for privileged administrative commands, including 'exec' operations on containers and the spawning of shell environments directly on the host operating system. Since the Periphery agent is conventionally deployed with elevated privileges to manage system resources and containers, commands executed through this bypass inherit root-level permissions. This transition from network-level bypass to arbitrary command execution results in total system control, including potential data exfiltration, lateral movement within the network, or the deployment of persistent backdoors. The vulnerability affects all versions of Komodo up to and including 2.3.3."
}