by Kastro
Paper/Archive/CVE-2026-111322

CVE-2026-111322

coleam00 Archon — Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API

EPSS 0.9%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 59.4.594 × 2011.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.

Affected

ProductAffectedFixed inSource
Archon0.2.13 – 0.11.1–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploithackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-defaultwriteupgithub.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756writeupgithub.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27writeupgithub.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909refgithub.com/coleam00/Archonwriteupvulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api