Search
Find a vulnerability
Search criteria
4 vulnerabilities found for komodo by moghtech
CVE-2026-110631 (GCVE-0-2026-110631)
Vulnerability from nvd – Published: 2026-10-14 14:17 – Updated: 2026-10-20 01:20
VLAI
EPSS
VEX
Title
Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
Summary
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 01:19 UTC
CWE
- CWE-1188 - Initialization of a Resource with an Insecure Default
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/moghtech/komodo/issues/1690 | issue-tracking |
| https://github.com/moghtech/komodo/blob/v2.3.3/bi… | technical-description |
| https://github.com/moghtech/komodo/blob/v2.3.3/bi… | technical-description |
| https://github.com/moghtech/komodo/blob/v2.3.3/co… | technical-description |
| https://github.com/moghtech/komodo/blob/v1.19.5/b… | technical-description |
| https://ravindulakmina.pages.dev/advisories/komod… | technical-description |
| https://www.vulncheck.com/advisories/komodo-throu… | third-party-advisory |
| https://ravindulakmina.pages.dev/advisories/cve-2… | exploit |
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110631",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T01:19:35.328506Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T01:20:12.584Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://ravindulakmina.pages.dev/advisories/cve-2026-110631-komodo-periphery-fail-open-rce/"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "komodo",
"repo": "https://github.com/moghtech/komodo",
"vendor": "moghtech",
"versions": [
{
"lessThanOrEqual": "2.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ravindu Lakmina Munaweera"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "Initialization of a Resource with an Insecure Default",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T11:39:02.410Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/moghtech/komodo/issues/1690"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/state.rs#L82-L88"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/connection/server.rs"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/v2.3.3/config/periphery.config.toml"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/v1.19.5/bin/periphery/src/api/router.rs"
},
{
"tags": [
"technical-description"
],
"url": "https://ravindulakmina.pages.dev/advisories/komodo-periphery-fail-open-rce/"
},
{
"name": "VulnCheck Advisory: Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/komodo-through-2.3.3-periphery-agent-unauthenticated-rce-via-default-configuration"
}
],
"title": "Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110631",
"datePublished": "2026-10-14T14:17:05.199Z",
"dateReserved": "2026-10-14T13:07:30.444Z",
"dateUpdated": "2026-10-20T01:20:12.584Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82267 (GCVE-0-2026-82267)
Vulnerability from nvd – Published: 2026-08-28 16:18 – Updated: 2026-09-24 14:19
VLAI
EPSS
VEX
Title
Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check
Summary
Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:23 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/moghtech/komodo/issues/1455 | issue-tracking |
| https://github.com/moghtech/komodo | product |
| https://github.com/moghtech/komodo/blob/cc1c5aa5d… | technical-description |
| https://github.com/moghtech/komodo/blob/cc1c5aa5d… | technical-description |
| https://www.vulncheck.com/advisories/komodo-resou… | third-party-advisory |
Date Public
2026-06-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:23:33.405719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:55:11.444Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "komodo",
"vendor": "moghtech",
"versions": [
{
"lessThanOrEqual": "2.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:19:58.693Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1455",
"tags": [
"issue-tracking"
],
"url": "https://github.com/moghtech/komodo/issues/1455"
},
{
"tags": [
"product"
],
"url": "https://github.com/moghtech/komodo"
},
{
"name": "Vulnerable code: update.rs",
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/cc1c5aa5dabb738e843c47f5e87fc040648c2bb7/bin/core/src/helpers/update.rs"
},
{
"name": "Vulnerable code: mod.rs",
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/cc1c5aa5dabb738e843c47f5e87fc040648c2bb7/bin/core/src/api/execute/mod.rs"
},
{
"name": "VulnCheck Advisory: Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/komodo-resource-identifier-disclosure-and-audit-log-pollution-before-permission-check"
}
],
"title": "Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82267",
"datePublished": "2026-08-28T16:18:51.391Z",
"dateReserved": "2026-08-28T11:12:37.404Z",
"dateUpdated": "2026-09-24T14:19:58.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110631 (GCVE-0-2026-110631)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:17 – Updated: 2026-10-20 01:20
VLAI
EPSS
VEX
Title
Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
Summary
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 01:19 UTC
CWE
- CWE-1188 - Initialization of a Resource with an Insecure Default
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/moghtech/komodo/issues/1690 | issue-tracking |
| https://github.com/moghtech/komodo/blob/v2.3.3/bi… | technical-description |
| https://github.com/moghtech/komodo/blob/v2.3.3/bi… | technical-description |
| https://github.com/moghtech/komodo/blob/v2.3.3/co… | technical-description |
| https://github.com/moghtech/komodo/blob/v1.19.5/b… | technical-description |
| https://ravindulakmina.pages.dev/advisories/komod… | technical-description |
| https://www.vulncheck.com/advisories/komodo-throu… | third-party-advisory |
| https://ravindulakmina.pages.dev/advisories/cve-2… | exploit |
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110631",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T01:19:35.328506Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T01:20:12.584Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://ravindulakmina.pages.dev/advisories/cve-2026-110631-komodo-periphery-fail-open-rce/"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "komodo",
"repo": "https://github.com/moghtech/komodo",
"vendor": "moghtech",
"versions": [
{
"lessThanOrEqual": "2.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ravindu Lakmina Munaweera"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "Initialization of a Resource with an Insecure Default",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T11:39:02.410Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/moghtech/komodo/issues/1690"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/state.rs#L82-L88"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/connection/server.rs"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/v2.3.3/config/periphery.config.toml"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/v1.19.5/bin/periphery/src/api/router.rs"
},
{
"tags": [
"technical-description"
],
"url": "https://ravindulakmina.pages.dev/advisories/komodo-periphery-fail-open-rce/"
},
{
"name": "VulnCheck Advisory: Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/komodo-through-2.3.3-periphery-agent-unauthenticated-rce-via-default-configuration"
}
],
"title": "Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110631",
"datePublished": "2026-10-14T14:17:05.199Z",
"dateReserved": "2026-10-14T13:07:30.444Z",
"dateUpdated": "2026-10-20T01:20:12.584Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82267 (GCVE-0-2026-82267)
Vulnerability from cvelistv5 – Published: 2026-08-28 16:18 – Updated: 2026-09-24 14:19
VLAI
EPSS
VEX
Title
Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check
Summary
Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:23 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/moghtech/komodo/issues/1455 | issue-tracking |
| https://github.com/moghtech/komodo | product |
| https://github.com/moghtech/komodo/blob/cc1c5aa5d… | technical-description |
| https://github.com/moghtech/komodo/blob/cc1c5aa5d… | technical-description |
| https://www.vulncheck.com/advisories/komodo-resou… | third-party-advisory |
Date Public
2026-06-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:23:33.405719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:55:11.444Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "komodo",
"vendor": "moghtech",
"versions": [
{
"lessThanOrEqual": "2.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:19:58.693Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1455",
"tags": [
"issue-tracking"
],
"url": "https://github.com/moghtech/komodo/issues/1455"
},
{
"tags": [
"product"
],
"url": "https://github.com/moghtech/komodo"
},
{
"name": "Vulnerable code: update.rs",
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/cc1c5aa5dabb738e843c47f5e87fc040648c2bb7/bin/core/src/helpers/update.rs"
},
{
"name": "Vulnerable code: mod.rs",
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/cc1c5aa5dabb738e843c47f5e87fc040648c2bb7/bin/core/src/api/execute/mod.rs"
},
{
"name": "VulnCheck Advisory: Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/komodo-resource-identifier-disclosure-and-audit-log-pollution-before-permission-check"
}
],
"title": "Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82267",
"datePublished": "2026-08-28T16:18:51.391Z",
"dateReserved": "2026-08-28T11:12:37.404Z",
"dateUpdated": "2026-09-24T14:19:58.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}