{"data":{"id":"3aeb4c13-fd16-44a4-80e5-65eb3de48921","title":"CVE-2026-111322: Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to…","summary":"Archon versions 0.2.13 through 0.11.1 lack authentication on the /api/* control API, which binds to 0.0.0.0 by default. Unauthenticated attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, and execute commands on the host as the Archon user.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111322","publishedAt":"2026-10-15T22:19:30.633Z","cveId":"CVE-2026-111322","cweIds":["CWE-306"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Archon","AI coding agent"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Archon missing authentication exposes control API to unauthenticated attackers","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-16T00:10:15.337Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-16T00:10:18.307Z","patchAvailable":null,"disclosureDate":"2026-10-15T22:19:30.633Z","capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}