Komodo
Monthly
Unauthenticated remote code execution affects Komodo through 2.3.3 via its Periphery agent, which fails open when its core_public_keys and passkeys allowlists are left empty - the shipping default. Any attacker who can reach the agent's TCP port 8120 can present a self-generated keypair, be accepted as a trusted Core, and issue Periphery API calls that include terminal sessions and container operations, resulting in command execution on managed hosts typically as root. The CVSS 4.0 base score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N, high confidentiality/integrity/availability), consistent with an independent assessment of CVSS 3.1 9.3; no public exploit code and no CISA KEV entry were identified at time of analysis, though the default-configuration exposure makes exploitation trivial wherever port 8120 is reachable.
Komodo through version 2.3.2 leaks internal resource identifiers and pollutes its audit log because the /execute and /execute/{variant} API handlers resolve resource names and write audit records before enforcing authorization checks. Authenticated low-privileged users can enumerate internal resource identifiers they lack permission to access and inject fraudulent audit entries that falsely attribute privileged operations, undermining forensic and compliance integrity. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated remote code execution affects Komodo through 2.3.3 via its Periphery agent, which fails open when its core_public_keys and passkeys allowlists are left empty - the shipping default. Any attacker who can reach the agent's TCP port 8120 can present a self-generated keypair, be accepted as a trusted Core, and issue Periphery API calls that include terminal sessions and container operations, resulting in command execution on managed hosts typically as root. The CVSS 4.0 base score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N, high confidentiality/integrity/availability), consistent with an independent assessment of CVSS 3.1 9.3; no public exploit code and no CISA KEV entry were identified at time of analysis, though the default-configuration exposure makes exploitation trivial wherever port 8120 is reachable.
Komodo through version 2.3.2 leaks internal resource identifiers and pollutes its audit log because the /execute and /execute/{variant} API handlers resolve resource names and write audit records before enforcing authorization checks. Authenticated low-privileged users can enumerate internal resource identifiers they lack permission to access and inject fraudulent audit entries that falsely attribute privileged operations, undermining forensic and compliance integrity. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.