CVE-2026-111322
Critical · CVSS 9.3Published 2026-10-15
CVSS
9.3
Critical
EPSS
—
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-111322?
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.
CVSS Score Explained
CVSS 9.3 is Critical — the highest severity tier. Attackers can likely exploit this remotely with no authentication and cause full system compromise. Patch immediately.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/coleam00/Archon
- ›https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27
- ›https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909
- ›https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756
- ›https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default
- ›https://www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-8311Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-5819Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-2937Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107316Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107172Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2025-3778Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—