Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Archon lets anyone on the network run commands

CVE-2026-111322 · published today
Summary

Versions 0.2.13 through 0.11.1 of Archon expose a control interface that does not require a login. Anyone who can reach the server over the network can send messages that cause the AI coding agent to execute commands on the host as the Archon user. Limit network access to the API, enable authentication or bind the service to localhost, and apply the latest update that adds proper access controls.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
coleam00 archon <= 0.11.1
Original advisory text
Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-111322 · NVD
CVE-2026-111322 · MITRE
Track software like this
Free during beta