CVE-2026-111322

Name of the Vulnerable Software and Affected Versions Archon versions 0.2.13 through 0.11.1

Description Missing authentication allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which operates with bypassPermissions, enabling remote command execution on the host as the Archon user.

Recommendations As a temporary workaround, firewall the /api/* endpoint to restrict network access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.