CVE-2026-110631
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect
CVSS
9.8
Critical
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Oct 14, 2026 · Last modified: Oct 14, 2026 · CWE-1188
Not enough EPSS history yet.
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
- github.comhttps://github.com/moghtech/komodo/blob/v1.19.5/bin/periphery/src/api/router.rs
- github.comhttps://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/connection/server.rs
- github.comhttps://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/state.rs#L82-L88
- github.comhttps://github.com/moghtech/komodo/blob/v2.3.3/config/periphery.config.toml
- github.comhttps://github.com/moghtech/komodo/issues/1690
- ravindulakmina.pages.devhttps://ravindulakmina.pages.dev/advisories/komodo-periphery-fail-open-rce/
- www.vulncheck.comhttps://www.vulncheck.com/advisories/komodo-through-2.3.3-periphery-agent-unauthenticated-rce-via-default-configuration
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-774275.9 MED—
——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can activate a published legacy compatibility key. If an attacker separately obtains ciphertext-bearing account or configuration files, the known fallback key can enable decryption of TOTP secrets or credentials. Docker installations already generated a unique persistent key, and existing installations are not automatically rotated because doing so could make encrypted state unreadable. This issue is fixed in version 3.22.0.12hCVE-2026-1107698.6 HIG—
——0holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.14hCVE-2026-147657.7 HIG31.0%
——9Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).1dCVE-2026-537099.8 CRI37.7%
——11MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.2dCVE-2026-891207.1 HIG13.7%
——4A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.2dCVE-2026-891054.2 MED3.2%
——1The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that should not be accepted, leading to a breach of security.2d