Archon: control API (application programming interface), with its identity check off by default and open on all network interfaces, lets anyone who can reach it send instructions to an AI coding agent that runs without permission prompts; the CVE (Common Vulnerabilities and Exposures) record says this runs host commands, the reporter says that is not established; published 15 October 2026, no fix named
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | not evidenced in source | assertion | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands | low |
| Mandate: objective | not evidenced in source | assertion | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands | low |
| Actor | The AI coding agent run by Archon 0.2.13 through 0.11.1, which runs with bypassPermissions | fact | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands; CVE record CVE-2026-111322 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-306, affected range, credits | high |
| Inputs | Messages sent to the AI coding agent through the /api/* control API by an unauthenticated attacker with network access; the API binds to 0.0.0.0 by default | fact | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands; CVE record CVE-2026-111322 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-306, affected range, credits | high |
| Decision | not evidenced in source | assertion | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands | low |
| Envelope: constraints | In a default install the /api/* control API checks no identity: its gate is on only when the operator sets both a DATABASE_URL (a Postgres database) and a BETTER_AUTH_SECRET, which a default SQLite install does not, and the server binds to 0.0.0.0 (all network interfaces) unless HOST is set. The agent runs in bypassPermissions mode, which Archon's security page says means 'There is no per-action confirmation step'. The same page says SQLite and solo installs 'have no built-in user authentication' and tells operators to protect the web interface with basic or form authentication when exposing it publicly | fact | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands; CVE record CVE-2026-111322 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-306, affected range, credits; Archon OS control API has no authentication by default and binds to all interfaces; Archon documentation page 'Security' (packages/docs-web/src/content/docs/reference/security.md at tag v0.11.1) | high |
| Action | VulnCheck's CVE record states that attackers' messages lead the agent to execute commands on the host as the Archon user. The reporter's write-up, which the record cites, says this was not run and that host command execution is 'not established'; it says an unauthenticated caller can start workflow runs, send messages into agent conversations and approve or reject the agent's paused actions, with effects that depend on the workflows configured. Archon's own security page says the agent 'can run shell commands' with 'no per-action confirmation step' | assertion | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands; CVE record CVE-2026-111322 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-306, affected range, credits; Archon OS control API has no authentication by default and binds to all interfaces; Archon documentation page 'Security' (packages/docs-web/src/content/docs/reference/security.md at tag v0.11.1) | medium |
| Outcome | State: pending (no fix has shipped). No exploitation reported in the sources. The flaw has not been shown running: the reporter found it by reading the source and sent no requests. The US Cybersecurity and Infrastructure Security Agency's (CISA) enrichment of the CVE record (16 October 2026) nonetheless rates exploitation 'poc' (a public proof of concept) and tags the reporter's write-up as an exploit. As of 21 Oct 2026. | assertion | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands; CVE record CVE-2026-111322 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-306, affected range, credits; Archon OS control API has no authentication by default and binds to all interfaces | medium |
| Evidence: event | CVE-2026-111322, assigned by VulnCheck as CVE Numbering Authority (reserved and published 15 October 2026); weakness CWE-306 (Common Weakness Enumeration: Missing Authentication for Critical Function); VulnCheck's severity scores CVSS (Common Vulnerability Scoring System) version 4.0 9.3 and version 3.1 9.8, which the National Vulnerability Database lists as VulnCheck's without scoring the record itself (status Deferred); affected versions 0.2.13 through 0.11.1; finder credited as hieuPenguinnn, whose write-up of 14 October 2026 reviewed the source at v0.11.1 and states 'Runtime validation was NOT performed'; the US Cybersecurity and Infrastructure Security Agency's enrichment of 16 October 2026 rates exploitation 'poc' (proof of concept) | fact | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands; CVE record CVE-2026-111322 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-306, affected range, credits; Archon OS control API has no authentication by default and binds to all interfaces | high |
| Recovery: technical | No fixed version is named in the CVE record or in Archon's changelog. Archon released 0.12.0 and 0.12.1 on 17 October 2026; the changelog names no fix for this flaw, and the server source at v0.12.1 still binds to 0.0.0.0 unless HOST is set and still skips the API identity check unless DATABASE_URL and BETTER_AUTH_SECRET are set. Archon's security page at v0.12.1 says 'The console with web auth off and no resolved identity is also the operator'. The CVE record's affected range has not been extended past 0.11.1 | fact | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands; CVE record CVE-2026-111322 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-306, affected range, credits; coleam00/Archon CHANGELOG.md at tag v0.12.1: releases 0.12.0 and 0.12.1 of 17 October 2026 (server source and security page read at the same tag) | high |
| Recovery: accountability | not evidenced in source | assertion | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands; CVE record CVE-2026-111322 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-306, affected range, credits | low |
Controls
| Status | Control | Canonical |
|---|---|---|
| absent | Mechanism: in a default install the /api/* control API passes messages, workflow runs and approvals for the coding agent from any caller with network access without checking identity; the gate that would check is on only when DATABASE_URL and BETTER_AUTH_SECRET are both set. Why it interrupts: the reporter says that with that gate on, other routes return 401 (unauthorised) and 'In that configuration the finding does not apply'. Source shows it absent: the CVE record states missing authentication (CWE-306, Common Weakness Enumeration: Missing Authentication for Critical Function) on the control API, and the reporter quotes the code `if (!isApiGateEnabled()) return next();`. | C-A1 Actor identity verification |
| absent | Mechanism: the agent acts on received messages in bypassPermissions mode. Why it interrupts: a confirmation step before an action would put a human decision between the attacker's message and the action; no source shows this counterfactual, and the reporter notes that workflow approval gates, where a workflow has them, can themselves be approved by the same unauthenticated caller, so such a step would interrupt only if its approval were authenticated. Source shows it absent: Archon's security page says the agent can 'read, write, and execute files without interactive confirmation prompts' and 'There is no per-action confirmation step'; the CVE record names the bypassPermissions mode. | C-E3 Destructive-action gate |
Inference
inference The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE (Common Vulnerabilities and Exposures) record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established, that what a driven run does depends on the workflows and agent configured, and that turning on web authentication makes the finding not apply, while binding to the local machine only removes the network reach. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| NVD-111322 | NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands | public record primary record | nvd.nist.gov ↗ checked 2026-10-16 |
| CVE-111322 | CVE record CVE-2026-111322 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-306, affected range, credits | public record secondary | cve.threatint.com ↗ checked 2026-10-16 |
| HACKMD | Archon OS control API has no authentication by default and binds to all interfaces | researcher primary record | hackmd.io ↗ checked 2026-10-21 |
| ARCHON-SEC | Archon documentation page 'Security' (packages/docs-web/src/content/docs/reference/security.md at tag v0.11.1) (interest: vendor describing its own system) | company primary record | raw.githubusercontent.com ↗ checked 2026-10-21 |
| ARCHON-0121 | coleam00/Archon CHANGELOG.md at tag v0.12.1: releases 0.12.0 and 0.12.1 of 17 October 2026 (server source and security page read at the same tag) (interest: vendor describing its own system) | company primary record | raw.githubusercontent.com ↗ checked 2026-10-21 |