What happened
CVE-2026-111322 (CVSS 9.8 v3.1 / 9.3 v4.0, CWE-306) verified via NVD REST API (published 2026-10-15 by VulnCheck, status Deferred): the /api/* control API of the Archon AI coding-agent server is missing authentication and binds to 0.0.0.0 by default, so any network-reachable attacker can inject messages into the coding agent, which runs with bypassPermissions, yielding host command execution as the Archon user.
Why it matters
A classic example of the emerging default-insecure agent-framework class: the thing meant to control the agent is itself unauthenticated and bound to all interfaces. Since the agent bypasses permission gating, an attacker needs no credentials at all to reach real command execution on the host plus steal agent secrets. Any exposed Archon install is effectively root-by-default.
Attack vector
Unauthenticated network access to the /api/* control API: attacker sends messages to the AI coding agent, which runs with bypassPermissions, executing commands on the host as the Archon user. Also enables credential/config extraction and agent manipulation.
Affected systems
Archon 0.2.13–0.11.1 (coleam00/Archon — the popular Dify-based AI agent builder framework)
Mitigation
Vendor CNA (VulnCheck) records version ≤0.11.1 as affected; restrict/authenticate access to the control API, do not expose 0.0.0.0:port to untrusted networks, and upgrade. See VulnCheck advisory.