CVE-2026-111322

9.8Critical

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-306

Impact

Unauthenticated attackers with network access can execute arbitrary commands on the host as the Archon user. They only need reachability to the default network-exposed /api/* endpoint.

Root cause

The control API binds to all interfaces (0.0.0.0) without requiring authentication and passes input directly to an AI agent configured to bypass permissions.

Affected systems

Archon 0.2.13 through 0.11.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a fixed version beyond 0.11.1 if available; otherwise, restrict the service to bind only to localhost or block incoming network traffic to the Archon API port via firewall.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111322