Archon versions 0.2.13 through 0.11.1 expose an unauthenticated /api/* control API. Anyone with network access can use it to make the AI coding agent run commands on the host.
What Is It
CVE-2026-111322 is a missing authentication vulnerability (CWE-306) in Archon, an open-source project maintained by coleam00 on GitHub. Its /api/* control API has no authentication, and by default it binds to 0.0.0.0. That means it listens on every network interface, not just the machine's own loopback address.
An attacker who can reach the API can send messages directly to Archon's AI coding agent. The agent runs with bypassPermissions, so it carries out those instructions without the usual permission checks. The result is command execution on the host as the user running Archon.
VulnCheck disclosed the issue, and NVD published it on 2026-10-15. Its NVD status is currently "Received."
Why It Matters
VulnCheck rates this flaw 9.8 (Critical) under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 (Critical) under CVSS 4.0. Both scores mean:
- Network-reachable: the API is exposed on all interfaces by default.
- No authentication or user interaction required.
- Low attack complexity.
- High impact to confidentiality, integrity, and availability.
Because the agent bypasses permissions, the API can work much like a remote shell for anyone who can reach it. Archon instances left on the default configuration and reachable over the network, whether on a shared LAN, a cloud host or the internet, are likely to be at risk.
As of publication, CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog. That does not rule out exploitation; it means CISA has not publicly confirmed any. A public technical write-up is listed among the references.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| coleam00 | Archon | 0.2.13 through 0.11.1 (inclusive) |
- Package URL:
pkg:github/coleam00/Archon - The NVD record does not list any affected CPEs.
Patch Status
The NVD record does not name a fixed version. Every version from 0.2.13 through 0.11.1 is listed as affected. Archon is not in the KEV catalog, so there is no CISA-mandated remediation deadline.
Operators should:
- Check the Archon GitHub repository and the VulnCheck advisory for a patched release.
- Until a fix is confirmed, make sure the control API is not reachable from untrusted networks, because it binds to
0.0.0.0by default.
Sources
- NVD, CVE-2026-111322
- VulnCheck Advisory; Archon 0.2.13 through 0.11.1 Missing Authentication via API Control API
- Researcher Write-up (HackMD), Archon OS API Missing Authentication Default
- GitHub; coleam00/Archon
- GitHub; Archon v0.11.1 auth/config.ts
- GitHub; Archon v0.11.1 server index.ts
- GitHub; Archon v0.11.1 routes/api.ts