CVE-2026-111322

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.

CVSS 4.0

9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-25)

CWE

CWE-306

Published

2026-10-15

Modified

2026-10-16

Record from

the NVD, synced 2026-10-19

References

• https://github.com/coleam00/Archon
• https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27
• https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909
• https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756
• https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default

Check your stackJSON