Critical severity9.8NVD Advisory· Published Oct 15, 2026
CVE-2026-111322
CVE-2026-111322
Description
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: 0.2.13 - 0.11.1
Patches
Vulnerability mechanics
References
5- github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.tsnvd
- github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.tsnvd
- github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.tsnvd
- hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-defaultnvd
- www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-apinvd
News mentions
0No linked articles in our index yet.