Komodo Periphery EUVD-2026-101259

No special conditions in the default deployment: the Periphery agent ships with empty core_public_keys and passkeys lists, which fail open and accept any attacker-supplied keypair as a trusted Core - so an unconfigured, network-reachable agent is exploitable out of the box. The concrete prerequisite is network reachability to the Periphery agent's TCP port 8120. The primary LIMITING factor is that Periphery is designed to be reached only by the Core; instances where 8120 is firewalled or bound to a trusted management network/localhost are not remotely exploitable, and explicitly populating core_public_keys or passkeys closes the bypass. There is no user interaction and no authentication requirement (PR:N confirmed).

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) is fully consistent with the description: a network-reachable Periphery agent on port 8120 that fails open when core_public_keys and passkeys are empty - the default state - allowing an unauthenticated attacker to present any self-generated keypair and gain full API control, including terminal sessions and container operations that execute commands (typically as root) on managed hosts. CWE-1188 (insecure default initialization) matches precisely: the danger is in the shipped default, so any exposed-but-unconfigured instance is exploitable with no further conditions. Signals that are MISSING: no EPSS score was provided, this CVE is NOT in CISA KEV, and no POC flag was supplied, so there is no evidence of active exploitation or weaponization at this time - the urgency derives from exploit simplicity and impact, not from observed in-the-wild activity. The main mitigating factor is exposure scope: Periphery agents are intended to be reached only by the trusted Core, so risk concentrates on instances where port 8120 is reachable from untrusted networks (internet-exposed or flat internal networks).

An attacker scans for or discovers a Komodo Periphery agent listening on TCP port 8120 that was deployed with the default empty core_public_keys/passkeys configuration. Because authentication fails open, the attacker generates an arbitrary keypair, connects as a 'trusted' Core, and issues Periphery API calls to open a terminal session or manipulate containers - executing arbitrary commands on the managed host, typically with root privileges. No public exploit was identified at time of analysis, but the attack requires no special tooling and no authentication.