---
id: CVE-2026-111322
title: Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API
summary: >-
  Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability
  that allows unauthenticated attackers to access the /api/* control API, which
  binds to 0.0.0.0 by default. Attackers with network access can send messages
  to th…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-306
vendor: coleam00
product: Archon
affected:
  - Archon >= 0.2.13 <= 0.11.1
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:43:31.045Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111322'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default
  - url: >-
      https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756
  - url: >-
      https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27
  - url: >-
      https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909
  - url: 'https://github.com/coleam00/Archon'
  - url: >-
      https://www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api
    label: >-
      VulnCheck Advisory: Archon 0.2.13 through 0.11.1 Missing Authentication
      via /api/* Control API
tags:
  - cve.org
ingestedAt: '2026-10-15T22:48:25.452Z'
---

## Overview

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.

## Affected

- `Archon >= 0.2.13 <= 0.11.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.