Unauthenticated RCE in Archon API

Archon versions 0.2.13 through 0.11.1 are susceptible to a critical authentication bypass vulnerability (CVE-2026-111322) affecting the control API endpoints. The application binds its control interface to 0.0.0.0 by default, exposing the API to all network interfaces. Because the service lacks proper access control for the /api/* namespace, unauthenticated remote attackers can interact with the embedded AI coding agent. The agent is configured to operate with elevated privileges, allowing successful exploitation to result in arbitrary command execution on the host machine under the security context of the Archon service user. This vulnerability represents a significant risk for any developer environments or production servers where Archon is exposed to network traffic.

Impact

Successful exploitation allows unauthenticated remote attackers to gain full command execution on the host machine. This grants the attacker the ability to exfiltrate source code, manipulate local files, or pivot further into the internal network from the compromised host. As of the disclosure date, the vulnerability affects all deployments within the specified version range.

Recommendation

• Immediately restrict network access to the Archon control API using host-based firewalls or network access control lists to prevent unauthenticated access from unauthorized segments.
• Upgrade Archon to a version beyond 0.11.1 as soon as the vendor provides a security patch to address the underlying authentication flaw.
• Audit host process logs for any unexpected child processes spawned by the Archon application user, as this indicates potential agent abuse or malicious command execution.