Archon CVE-2026-111322

Exploitation requires network reachability to the Archon control API, which listens on /api/* and binds to 0.0.0.0 by default, so default deployments expose it on all interfaces with no authentication layer (CWE-306). The attacker leverages the fact that the backing AI coding agent runs with bypassPermissions, meaning agent messages translate directly into host command execution as the Archon user. This affects Archon versions 0.2.13 through 0.11.1. No special configuration, authentication, or user interaction is needed against a default install. The primary limiting factor is exposure: instances rebound to 127.0.0.1/localhost, placed behind a firewall or reverse proxy with authentication, or otherwise network-isolated are not reachable by remote unauthenticated attackers despite the default binding.

This is a genuine high-priority issue, not an inflated CVSS score. All available signals align toward serious real-world risk: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, fully unauthenticated exploitation, and the vulnerable-system impacts are all High (VC:H/VI:H/VA:H), consistent with the description's claim of arbitrary command execution on the host. Because the control API binds to 0.0.0.0 by default and the backing AI agent runs with bypassPermissions, exploitation yields direct code execution with no privilege prerequisite - a near-worst-case profile for an exposed instance. No EPSS probability was supplied and the CVE is NOT in CISA KEV, so there is no evidence of confirmed active exploitation at this time; this remains a technical/pre-exploitation risk rather than a documented in-the-wild campaign. No explicit POC flag was provided in the input, though a detailed third-party technical writeup (hackmd) and a VulnCheck advisory exist and point to specific vulnerable source lines, which materially lowers the barrier to developing a working exploit. The main mitigating factor is exposure scope: the severity assumes the Archon port is reachable by the attacker; instances bound only to localhost or firewalled off are not remotely exploitable despite the default 0.0.0.0 binding.

An attacker who can reach an Archon instance's API port (exposed on 0.0.0.0 by default) sends an unauthenticated request to the /api/* control endpoints, delivering a crafted message to the AI coding agent. Because the agent executes with bypassPermissions, the attacker-supplied instruction is carried out as a shell command on the host under the Archon user's privileges. Given AV:N/AC:L/PR:N/UI:N, this requires only network access and no authentication, user interaction, or special timing; a public technical writeup documenting the flaw exists, lowering the effort to weaponize.