EXPOSURES › CVE-2026-111322
CVE-2026-111322
CRITICALArchon 0.2.13-0.11.1 lacks authentication on its control API, allowing unauthenticated attackers to execute commands as the Archon user.
The missing authentication on Archon's /api/* control API, which binds to 0.0.0.0 by default, lets any network-accessible attacker send messages to the AI coding agent and execute commands on the host. This is a critical RCE vulnerability that directly violates CMMC/NIST 800-171 requirements for access control and system integrity, forcing DIB orgs to patch immediately and restrict network exposure.
Shame score — A missing authentication vulnerability on a control API binding to all interfaces is a negligent, avoidable failure that grants attackers direct command execution.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.