{"id":"CVE-2026-111322","published":"2026-10-15T22:19:30.633","lastModified":"2026-10-16T20:17:20.237","description":"Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/coleam00/Archon","tags":[]},{"url":"https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27","tags":[]},{"url":"https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909","tags":[]},{"url":"https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default","tags":[]},{"url":"https://www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default","tags":[]}],"exploitRefs":[{"url":"https://github.com/coleam00/Archon","tags":[]},{"url":"https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27","tags":[]},{"url":"https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909","tags":[]},{"url":"https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756","tags":[]}],"hasPoc":true,"ai":{"summary":"Archon contains a missing authentication vulnerability that allows unauthenticated attackers to access its control API and execute commands as the Archon user. This is a critical flaw because it enables remote code execution without any authentication requirements.","exploitability":"Exploitation is straightforward requiring only network access to the API endpoint, with no prerequisites beyond the vulnerable version range.","blast_radius":"The impact could be severe across all systems running vulnerable Archon versions, as attackers can execute arbitrary commands as the Archon user with potentially elevated privileges.","remediation":"Upgrade to Archon 0.11.2 or later to fix this authentication bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","rce","api"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:46:30.789Z"}}