CVE-2026-111322

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/coleam00/Archon
https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27
https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909
https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756
https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default
https://www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api
https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default

Configurations

No configuration.

History

16 Oct 2026, 20:17

Type	Values Removed	Values Added
References	~~() https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default -~~	() https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default -

15 Oct 2026, 22:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 22:19

Updated : 2026-10-16 20:17

NVD link : CVE-2026-111322

Mitre link : CVE-2026-111322

CVE.ORG link : CVE-2026-111322

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-111322", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111322", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:41:15.852229Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/coleam00/Archon", "vendor": "coleam00", "product": "Archon", "versions": [{"status": "affected", "version": "0.2.13", "versionType": "semver", "lessThanOrEqual": "0.11.1"}], "packageURL": "pkg:github/coleam00/Archon", "defaultStatus": "unaffected"}]}], "published": "2026-10-15T22:19:30.633", "references": [{"url": "https://github.com/coleam00/Archon", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user."}], "lastModified": "2026-10-16T20:17:20.237", "sourceIdentifier": "disclosure@vulncheck.com"}