Archon harness builder: unauthenticated /api/* control API on 0.0.0.0 drives a bypassPermissions coding agent (CVE-2026-111322, 9.3); no fix

View raw markdownEdit on GitHub ↗

TL;DR

Archon, the open-source "harness builder for AI coding" (23.7k stars) that runs Claude Code, Codex and Pi through YAML workflows, serves its /api/* control API with no authentication unless both a Postgres database URL and BETTER_AUTH_SECRET are set, and its server binds to 0.0.0.0 by default, so anyone who can reach the port can start workflow runs, send messages into agent conversations, approve the agent's paused actions and connect or disconnect provider keys (CVE-2026-111322, VulnCheck CNA, CVSS 4.0 9.3 and 3.1 9.8, published 2026-10-15). VulnCheck's record says the agent runs with bypassPermissions, so a message to it is command execution on the host as the Archon user. Affected 0.2.13 through 0.11.1, which is the newest release (2026-09-25). No fix, no release after 0.11.1 and no maintainer statement on record as of 2026-10-16. Until there is one: bind to 127.0.0.1, arm the auth gate, or firewall the port.

What happened

VulnCheck published CVE-2026-111322 on 2026-10-15 and credits hieuPenguinnn, the reporter behind the 2026-10-10 and 10-11 VulnCheck wave. The CNA record lists coleam00 Archon 0.2.13 through 0.11.1 inclusive, CWE-306, CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) and 3.1 9.8, and its description carries the one sentence that sets the severity: "Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user." Its references are the reporter's write-up, three source lines at tag v0.11.1 (packages/server/src/routes/api.ts, packages/server/src/auth/config.ts, packages/server/src/index.ts) and the repository.

The reporter's write-up is a source review of v0.11.1, and it says so: runtime validation was not performed. What it establishes from the code: the /api/* gate passes every request through when authentication is disabled, without resolving an identity; authentication is armed only when both a Postgres database URL and BETTER_AUTH_SECRET are set, and the default SQLite install sets neither; the server binds to 0.0.0.0 through a fallback in the HOST environment variable, and the shipped .env.example says "Set to 127.0.0.1 to restrict to localhost only." The mutating routes behind the gate cover conversations, workflow runs, approvals and provider-key connect and disconnect. The write-up does not use the words bypassPermissions; that claim is the CNA record's, so this file attributes it there. The write-up also cites issue #762, a request for API-key authentication, closed with a note that the Python codebase was being replaced; it gives no date for that issue and documents no maintainer response to this report.

The product is the audience's. The repository's About text is "The first open-source harness builder for AI coding," the README describes a workflow engine in which planning, implementation, validation, review and PR creation run as YAML steps, and the agents it drives are Claude (through a separately installed Claude Code), Codex and Pi. archon serve starts the web console the API serves. The releases page shows v0.11.1 (2026-09-25) as the newest release on 2026-10-16; the eight newest release notes mention neither authentication nor the bind address, although v0.9.0 (2026-08-17) narrowed what Claude nodes inherit (no ambient skills or MCP servers) and v0.11.0 (2026-09-25) refuses to start when a repository's .archon/.env sets HOME, PATH, WORKSPACE_PATH or ARCHON_HOME. The repository's security tab is empty. The issue list shows "fix(auth): operator chats are private to their owning user" (#3135) closed 2026-10-15; its title describes chat authorization, not the API gate, and no release carries it, so this file does not count it as a fix. The advisory database entered the record as GHSA-3q7p-hhhj-qh4p on 2026-10-16, unreviewed, with affected and patched versions "Unknown."

A second record on the same product, different code: OX Security disclosed CVE-2025-69443 on 2026-05-12 for the Python backend of Archon OS 0.1.0 through 0.3.11. The UI port (3737) enforced CORS and the backend port (8181) enforced neither CORS nor authentication, so a web page a user visited could read the configured LLM provider keys and drive agent features, and OX counted 24 Archon instances reachable from the internet with no authentication. OX reported it on 2025-11-24; the maintainer closed the issue on 2025-12-22 saying the app was meant to be local-only for now; no fix. That backend now lives on the archive/v1-task-management-rag branch. The write-up for the new record calls the two unrelated at the code level. They are the same shape: the control plane trusts whoever can reach the socket, and in the new code the thing behind the socket runs the coding agent with its permission prompts turned off.

Archon is not on a registry under its own name: npm view archon-os and npm view @coleam00/archon return 404 on 2026-10-16, and the project installs from its own release binaries and install script, so there is no npm audit or pip-audit signal for this record.

Am I affected?

archon --version 2>/dev/null                 # 0.2.13 through 0.11.1 = the affected range; 0.11.1 is the newest release
# Is the server reachable beyond loopback?
ss -ltnp 2>/dev/null | grep -i archon        # a 0.0.0.0 or [::] listener is reachable from the network
# Is the auth gate armed? (both a Postgres URL and the secret are needed, per the reporter's source review)
grep -E 'HOST|BETTER_AUTH_SECRET|DATABASE' .env ~/.archon/.env 2>/dev/null

Affected if the Archon server listens on a non-loopback address and the authentication gate is not armed, which is the default SQLite install. A host that runs Archon on a laptop behind a firewall is exposed to the local network; a VPS or a dev box with the port forwarded is exposed to the internet.

If you are affected

There is no upgrade. Set HOST=127.0.0.1 for archon serve, or arm the gate with a Postgres database URL and BETTER_AUTH_SECRET, or firewall the port to the clients that need it. Then read the run and conversation history for runs, messages and approvals you did not make: an approval you did not give is an action the agent took for someone else. If the port was reachable from a network you do not control, treat every credential the agent host holds (provider keys connected to Archon, Git credentials, cloud keys in the agents' environment) as exposed and follow if-your-local-ai-agent-was-exploited.md and rotating-cloud-credentials.md.

Prevention

  • A control plane for coding agents is an admin interface for your machine. Bind it to loopback by default and make the first authenticated request the first request. See agent-sandboxing.md.
  • An agent that runs with its permission prompts off needs the gate in front of it to be the control; here it is the only control, and it is off by default.

Sources