Archon CVE-2026-111322: coding agent API open, bind localhost

If you run Archon on a box other people can reach, anyone on that network can tell your coding agent what to do. CVE-2026-111322, published by VulnCheck on October 15, rates the Archon flaw 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0. Archon is a popular open-source harness for AI coding agents, with about 23,700 stars on GitHub. The bug is not exotic. It is a default.

What actually happened

Per the VulnCheck advisory:

• The flaw. Archon's /api/* control API has no authentication, and the server binds to 0.0.0.0 by default. That means every network interface, not just your own machine.
• The impact. An unauthenticated attacker can send messages to the coding agent. The agent runs with bypassPermissions, so it can execute commands on the host as the Archon user.
• The range. Versions 0.2.13 through 0.11.1.
• The patch. The advisory lists no fixed version. Archon shipped v0.12.0 and v0.12.1 on October 17. Their release notes do not mention this CVE, and in the v0.12.1 source we read, the server still defaults to HOST=0.0.0.0 and web login is still off unless you configure Postgres and an auth secret. Do not assume an upgrade closes it.

No public exploit is known yet. That will not last long for a bug this simple: find the port, send a message.

Why it matters for your business

This is the AI coding agent problem in one CVE. A normal web app with a missing login leaks data. An agent with a missing login runs code. Whoever can reach the port gets a developer with shell access who never says no.

Small teams are most exposed here. Someone runs archon serve on a shared dev server, a cloud VM, or an office machine so the whole team can use it. The firewall is "probably fine." That is the exact setup this bug punishes.

What we would do today:

• Bind to localhost. Set HOST=127.0.0.1. Reach it over SSH tunnel or a VPN, not a raw port.
• Put auth in front. If more than one person needs it, run it behind a reverse proxy with real login, or turn on Archon's own web auth.
• Check what is exposed. Scan your cloud security groups and office network for the Archon port. Assume a public IP is already found.
• Shrink the blast radius. Run the agent as a low-rights user in a container, with only the repos and secrets it needs.
• Treat every agent API as a shell. Any tool that accepts prompts and runs code gets the same review as SSH.

Sources: VulnCheck advisory, Archon on GitHub.