Evidence · DiggingBeagle record
CVE-2026-111322 Archon unauthenticated control API
Published CVE record reproducing the VulnCheck CNA description, affected versions, control route and network-to-agent command-execution chain.
- Published
- Oct 15, 2026
- Publisher
- OpenCVE / VulnCheck CVE record
- Source role
- secondary reporting
Evidence record
Published CVE record reproducing the VulnCheck CNA description, affected versions, control route and network-to-agent command-execution chain.
Claim-level citations (3)
- supportsArchon exposed a coding-agent control API without authentication: The CVE description states that a network-accessible client could send messages to an AI coding agent running with bypassPermissions, leading to command execution as the Archon user.
CVE JSON, containers.cna.descriptions
- supportsArchon exposed a coding-agent control API without authentication: The published CVE description says Archon versions 0.2.13 through 0.11.1 exposed the /api/* control API without authentication and bound that API to 0.0.0.0 by default.
CVE JSON, containers.cna.descriptions and affected.versions
- supportsArchon exposed a coding-agent control API without authentication: The published CVE record assigns CVSS 3.1 base score 9.8 and CVSS 4.0 base score 9.3 to the unauthenticated control API vulnerability; these are severity assessments, not counts of incidents.
CVE JSON, containers.cna.metrics, CVSS 3.1 and 4.0 vector and score