← Vulnerabilidades
CVE-2026-111322
Registro da vulnerabilidade com dados oficiais do NIST NVD, CISA KEV e FIRST EPSS.
Descrição
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.
- CVSS 3.x
- 9.8 CRITICAL
- Publicada
- 15/10/2026
- Atualizada
- 15/10/2026
- Status NVD
- Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fraqueza: CWE-306
Exploração
- No catálogo CISA KEV
- Não
- EPSS (FIRST)
- —
Referências
Links publicados no registro oficial
- https://github.com/coleam00/Archon
- https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27
- https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909
- https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756
- https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default
- https://www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api
Alguns navegadores bloqueiam sites oficiais abertos a partir da pré-visualização; copie o endereço para abrir em outra aba: https://nvd.nist.gov/vuln/detail/CVE-2026-111322