Komodo through version 2.3.3 implements an authentication bypass in its Periphery agent. The vulnerability originates from the agent defaulting to a fail‑open policy when the core_public_keys and passkeys lists are empty. An unauthenticated client reaching the exposed port 8120 can generate a key‑pair, present it to the agent, and gain the same trust level as the Core. This allows the attacker to invoke any Periphery API endpoint, including spawning terminal sessions and managing containers, effectively enabling remote code execution on the underlying host with the privileges of the Core process, usually root.

Affected systems are installations of Komodo up to and including version 2.3.3 from the vendor moghtech. The issue arises wherever the Periphery agent is deployed and the configuration still contains empty key lists, which is the default state for new deployments. Any Komodo instance running the default periphery.config.toml on port 8120 is vulnerable.

The CVSS score of 9.3 reflects the severity of remote code execution without authentication. The EPSS score is <1%, indicating a very low probability of exploitation; the vulnerability is not listed in the KEV catalog. Attackers only need network connectivity to port 8120; no credentials or prior compromise are required. Once connected, they can issue arbitrary commands and control the host as root, posing a critical risk to the entire managed environment.