CVE-2026-111322: fallo crítico en coleam00 Archon
Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.9%
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
coleam00 · ArchonReferencias
https://github.com/coleam00/Archonhttps://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-defaulthttps://www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api