---
id: CVE-2026-111322
title: >-
  Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability
  that allows unauthenticated attackers to access the /api/* control API, which
  binds to 0.0.0.0 by default
summary: >-
  Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability
  that allows unauthenticated attackers to access the /api/* control API, which
  binds to 0.0.0.0 by default. Attackers with network access can send messages
  to th…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: coleam00
product: Archon
affected:
  - Archon >= 0.2.13 <= 0.11.1
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:20.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111322'
references:
  - url: 'https://github.com/coleam00/Archon'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00892
epssPercentile: 0.59249
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T19:41:15.852229Z'
ingestedAt: '2026-10-15T22:48:25.452Z'
---

## Overview

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.