The Archon control API bound to 0.0.0.0 in the configuration described by the CVE record. Requests to /api/* were not authenticated while the controlled coding agent could run with bypassPermissions. An attacker with network access could submit agent messages that led to host commands executing under the Archon service identity. The issue combines an…
Inspect the ClaimsCase · DiggingBeagle record
Archon exposed a coding-agent control API without authentication
CVE-2026-111322 describes an unauthenticated API path that could send tasks to a coding agent configured to bypass permission prompts.
Scope
Archon versions 0.2.13 through 0.11.1 as listed in the public CVE record, where the control API is reachable over the network. Vulnerability advisory, not confirmed active exploitation.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- not established
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
The VulnCheck CNA description and affected-version data were inspected through the published CVE record. The described vulnerable software accepts network-origin commands when the API is reachable; no confirmed exploit in the wild or verified fixed version was established. A possible high impact is not a measured impact and is not graded here.
Assessed Oct 16, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ARCHON-EXEC · CLM-ARCHON-NOAUTH · CLM-ARCHON-SCORES · CVE-2026-111322 Archon unauthenticated control API
At a glance
The effective security boundary must be at the agent control API and process permissions. A model-specific refusal is not a reliable replacement for authentication and narrow execution rights.
Read the implicationsThe checked CVE metadata did not identify a fixed version. The availability of the control endpoint to untrusted clients and the process privileges differ by deployment. Real-world exploitation and victims were not established by this advisory. The CVE severity vector describes potential impact under its assumptions. It does not constitute evidence of…
Limits and uncertaintyFull account
The Archon control API bound to 0.0.0.0 in the configuration described by the CVE record. Requests to /api/* were not authenticated while the controlled coding agent could run with bypassPermissions. An attacker with network access could submit agent messages that led to host commands executing under the Archon service identity. The issue combines an exposed control plane with effective agent process authority, rather than a linguistic prompt-injection bypass alone. The disclosed chain needs a reachable network listener and a control route accepting unauthenticated messages. If those conditions hold, the agent is not merely generating advice: it can invoke tools with the process permissions available to Archon. The public CVE record establishes a described software vulnerability and its severity rating, but does not establish that any particular server was exposed or compromised. The CVE range should not be interpreted as evidence that later releases are safe without checking a vendor fix.
Mechanism and trust boundary
- 01
Unauthenticated control endpoint
An attacker reaches the default-bound Archon /api/* listener.
Boundary: network client to Archon agent control plane
- 02
Message enters agent task loop
The endpoint passes attacker-origin instructions to the coding agent.
Boundary: untrusted client input to high-authority agent
- 03
Agent executes a command
Agent operations with bypassPermissions execute on the host as the Archon user.
Boundary: agent command request to operating-system effect
Timeline
- Oct 15, 2026disclosure
Public disclosure
Claims & evidence
CLM-ARCHON-EXECThe CVE description states that a network-accessible client could send messages to an AI coding agent running with bypassPermissions, leading to command execution as the Archon user.supported
Basis: reported finding
- supportsCVE-2026-111322 Archon unauthenticated control APIsecondary reporting
CVE JSON, containers.cna.descriptions
CLM-ARCHON-NOAUTHThe published CVE description says Archon versions 0.2.13 through 0.11.1 exposed the /api/* control API without authentication and bound that API to 0.0.0.0 by default.supported
Basis: reported finding
- supportsCVE-2026-111322 Archon unauthenticated control APIsecondary reporting
CVE JSON, containers.cna.descriptions and affected.versions
CLM-ARCHON-SCORESThe published CVE record assigns CVSS 3.1 base score 9.8 and CVSS 4.0 base score 9.3 to the unauthenticated control API vulnerability; these are severity assessments, not counts of incidents.supported
Basis: reported finding
- supportsCVE-2026-111322 Archon unauthenticated control APIsecondary reporting
CVE JSON, containers.cna.metrics, CVSS 3.1 and 4.0 vector and score
Implications
The effective security boundary must be at the agent control API and process permissions. A model-specific refusal is not a reliable replacement for authentication and narrow execution rights.
Controls and mitigations
- Require authenticated, explicitly authorized access to agent control endpoints and avoid untrusted network exposure.
- Do not assign broad host execution rights to externally addressable coding agents.
- Until a specific fixed build and configuration are verified, bind the control API to a trusted interface or put it behind effective network access controls. This reduces exposure but does not replace endpoint authentication.
- Require authentication and separate authorization for dispatching agent tasks, then constrain the operating-system account and any command-execution tool. A firewall alone is insufficient against clients already inside the trusted network.
Unknowns and contradictions
- The checked CVE metadata did not identify a fixed version.
- The availability of the control endpoint to untrusted clients and the process privileges differ by deployment.
- Real-world exploitation and victims were not established by this advisory.
- The CVE severity vector describes potential impact under its assumptions. It does not constitute evidence of exploited installations or of data theft.
Sources and citation
Material revision history
- Oct 16, 2026 · Canonical change recorded · new in release · revision 157