VulnSocial

CVE-2026-111322

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-16: 110-16
Referenced assets1 URL
Full discourse1 post
  • AI Cyber Brief@justelite

    CVE-2026-111322 (CVSS 9.3): Archon 0.2.13–0.11.1 serves /api/* with no auth and binds to 0.0.0.0. Network callers can message the coding agent, which runs with bypassPermissions — host RCE as the Archon user. No patch yet; firewall that API now. https://www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api

    0002051
    1.7K followersView on X

Explore more

Back to dashboard