CVE-2026-111322: Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to network-based exploitation?
Archon versions 0.2.13 through 0.11.1 are affected when the control API is reachable over the network. The API binds to 0.0.0.0 by default, so deployments may be exposed beyond localhost unless network access is restricted.
Does an attacker need credentials or user interaction?
No. The vulnerability permits unauthenticated access to the /api/* control API, and an attacker needs network access to that API endpoint.
What level of host access can exploitation provide?
An attacker can send messages to the AI coding agent, which operates with bypassPermissions. This can result in command execution on the host as the Archon user.
What can be done if updating is not immediately possible?
Restrict network access to the /api/* control API so untrusted clients cannot reach it. Because the API binds to all interfaces by default, verify that firewall, network-policy, or other access controls limit exposure.