CVE-2026-111322
CVSS: 9.8v3.1CriticalReceived
Published 2026-10-15Last modified 2026-10-15
Vulnerability summary
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
Not scored
0%100%
No EPSS score yetKEVNot listed0 of 3 catalogs
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 2026-10-15PublishedVulnerability first disclosed.
Description
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.
CVSS metrics
4 scores · 2 sources · 2 versionsCritical 9.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 2 agree
- NVDNIST9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Coleam001 product
- archon≥ 0.2.13, ≤ 0.11.1
1 vendor · 1 product
References
6 links- hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-defaultThird Party Advisory
- github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.tsTechnical Description
- github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.tsTechnical Description
- github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.tsTechnical Description
- github.com/coleam00/ArchonProduct