---
id: 2026-10-archon-harness-builder-unauthenticated-control-api-agent-command-execution-cve-2026-111322
title: "Archon harness builder: unauthenticated /api/* control API on 0.0.0.0 drives a bypassPermissions coding agent (CVE-2026-111322, 9.3); no fix"
date_disclosed: 2026-10-15
last_updated: 2026-10-16
severity: critical
status: active
ecosystems: [typescript, agent-frameworks, github-source, claude-code, codex]
tools_affected: ["Archon (coleam00/Archon) 0.2.13 through 0.11.1, the newest release (2026-09-25)", "any `archon serve` install on the default SQLite setup, which arms no authentication", "the Claude Code, Codex or Pi agents Archon drives on that host", "the archived Python Archon OS 0.1.0 through 0.3.11 (CVE-2025-69443, separate code, same shape)"]
tags: [cve, agent-framework, harness, control-plane, missing-authentication, default-bind, bypasspermissions, claude-code, codex, vulncheck, no-fix, zero-files-product, excessive-agency]
---

## TL;DR
Archon, the open-source "harness builder for AI coding" (23.7k stars) that runs Claude Code, Codex and Pi through YAML workflows, serves its `/api/*` control API with no authentication unless both a Postgres database URL and `BETTER_AUTH_SECRET` are set, and its server binds to `0.0.0.0` by default, so anyone who can reach the port can start workflow runs, send messages into agent conversations, approve the agent's paused actions and connect or disconnect provider keys (CVE-2026-111322, VulnCheck CNA, CVSS 4.0 9.3 and 3.1 9.8, published 2026-10-15). VulnCheck's record says the agent runs with `bypassPermissions`, so a message to it is command execution on the host as the Archon user. Affected 0.2.13 through 0.11.1, which is the newest release (2026-09-25). No fix, no release after 0.11.1 and no maintainer statement on record as of 2026-10-16. Until there is one: bind to `127.0.0.1`, arm the auth gate, or firewall the port.

## What happened

VulnCheck published CVE-2026-111322 on 2026-10-15 and credits hieuPenguinnn, the reporter behind [the 2026-10-10 and 10-11 VulnCheck wave](2026-10-vulncheck-single-researcher-agent-mcp-gateway-cve-wave-mini-swe-agent-env-leak.md). The CNA record lists `coleam00 Archon` 0.2.13 through 0.11.1 inclusive, CWE-306, CVSS 4.0 9.3 (`AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H`) and 3.1 9.8, and its description carries the one sentence that sets the severity: "Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user." Its references are the reporter's write-up, three source lines at tag `v0.11.1` (`packages/server/src/routes/api.ts`, `packages/server/src/auth/config.ts`, `packages/server/src/index.ts`) and the repository.

The reporter's write-up is a source review of `v0.11.1`, and it says so: runtime validation was not performed. What it establishes from the code: the `/api/*` gate passes every request through when authentication is disabled, without resolving an identity; authentication is armed only when both a Postgres database URL and `BETTER_AUTH_SECRET` are set, and the default SQLite install sets neither; the server binds to `0.0.0.0` through a fallback in the `HOST` environment variable, and the shipped `.env.example` says "Set to 127.0.0.1 to restrict to localhost only." The mutating routes behind the gate cover conversations, workflow runs, approvals and provider-key connect and disconnect. The write-up does not use the words `bypassPermissions`; that claim is the CNA record's, so this file attributes it there. The write-up also cites issue #762, a request for API-key authentication, closed with a note that the Python codebase was being replaced; it gives no date for that issue and documents no maintainer response to this report.

The product is the audience's. The repository's About text is "The first open-source harness builder for AI coding," the README describes a workflow engine in which planning, implementation, validation, review and PR creation run as YAML steps, and the agents it drives are Claude (through a separately installed Claude Code), Codex and Pi. `archon serve` starts the web console the API serves. The releases page shows `v0.11.1` (2026-09-25) as the newest release on 2026-10-16; the eight newest release notes mention neither authentication nor the bind address, although `v0.9.0` (2026-08-17) narrowed what Claude nodes inherit (no ambient skills or MCP servers) and `v0.11.0` (2026-09-25) refuses to start when a repository's `.archon/.env` sets `HOME`, `PATH`, `WORKSPACE_PATH` or `ARCHON_HOME`. The repository's security tab is empty. The issue list shows "fix(auth): operator chats are private to their owning user" (#3135) closed 2026-10-15; its title describes chat authorization, not the API gate, and no release carries it, so this file does not count it as a fix. The advisory database entered the record as GHSA-3q7p-hhhj-qh4p on 2026-10-16, unreviewed, with affected and patched versions "Unknown."

A second record on the same product, different code: [OX Security disclosed CVE-2025-69443](https://www.ox.security/blog/cve-2025-69443-archon-os-vulnerable-to-unauthenticated-web-to-client-attack/) on 2026-05-12 for the Python backend of Archon OS 0.1.0 through 0.3.11. The UI port (3737) enforced CORS and the backend port (8181) enforced neither CORS nor authentication, so a web page a user visited could read the configured LLM provider keys and drive agent features, and OX counted 24 Archon instances reachable from the internet with no authentication. OX reported it on 2025-11-24; the maintainer closed the issue on 2025-12-22 saying the app was meant to be local-only for now; no fix. That backend now lives on the `archive/v1-task-management-rag` branch. The write-up for the new record calls the two unrelated at the code level. They are the same shape: the control plane trusts whoever can reach the socket, and in the new code the thing behind the socket runs the coding agent with its permission prompts turned off.

Archon is not on a registry under its own name: `npm view archon-os` and `npm view @coleam00/archon` return 404 on 2026-10-16, and the project installs from its own release binaries and install script, so there is no `npm audit` or `pip-audit` signal for this record.

## Am I affected?

```bash
archon --version 2>/dev/null                 # 0.2.13 through 0.11.1 = the affected range; 0.11.1 is the newest release
# Is the server reachable beyond loopback?
ss -ltnp 2>/dev/null | grep -i archon        # a 0.0.0.0 or [::] listener is reachable from the network
# Is the auth gate armed? (both a Postgres URL and the secret are needed, per the reporter's source review)
grep -E 'HOST|BETTER_AUTH_SECRET|DATABASE' .env ~/.archon/.env 2>/dev/null
```

Affected if the Archon server listens on a non-loopback address and the authentication gate is not armed, which is the default SQLite install. A host that runs Archon on a laptop behind a firewall is exposed to the local network; a VPS or a dev box with the port forwarded is exposed to the internet.

## If you are affected

There is no upgrade. Set `HOST=127.0.0.1` for `archon serve`, or arm the gate with a Postgres database URL and `BETTER_AUTH_SECRET`, or firewall the port to the clients that need it. Then read the run and conversation history for runs, messages and approvals you did not make: an approval you did not give is an action the agent took for someone else. If the port was reachable from a network you do not control, treat every credential the agent host holds (provider keys connected to Archon, Git credentials, cloud keys in the agents' environment) as exposed and follow [if-your-local-ai-agent-was-exploited.md](../playbooks/if-your-local-ai-agent-was-exploited.md) and [rotating-cloud-credentials.md](../playbooks/rotating-cloud-credentials.md).

## Prevention

- A control plane for coding agents is an admin interface for your machine. Bind it to loopback by default and make the first authenticated request the first request. See [agent-sandboxing.md](../prevention/agent-sandboxing.md).
- An agent that runs with its permission prompts off needs the gate in front of it to be the control; here it is the only control, and it is off by default.

## Sources
- [CVE-2026-111322, CVE Services record (VulnCheck CNA)](https://cveawg.mitre.org/api/cve/CVE-2026-111322) — affected range, scores, the `bypassPermissions` sentence, references, credit; fetched 2026-10-16.
- [VulnCheck advisory](https://www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api) — 2026-10-15, CWE-306, no fixed version stated.
- [hieuPenguinnn, Archon OS API missing authentication by default](https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default) — the source review of `v0.11.1`: the gate's pass-through, the two-variable arming condition, the `0.0.0.0` fallback and `.env.example` line, the mutating routes, issue #762; "runtime validation was not performed."
- [GHSA-3q7p-hhhj-qh4p, GitHub Advisory Database](https://github.com/advisories/GHSA-3q7p-hhhj-qh4p) — unreviewed entry, 2026-10-16, versions "Unknown."
- [coleam00/Archon](https://github.com/coleam00/Archon) — About text, README (agents driven, `archon serve`, telemetry), 23.7k stars on 2026-10-16; [releases](https://github.com/coleam00/Archon/releases) — `v0.11.1` newest, the `v0.9.0` and `v0.11.0` notes; [issue search "authentication api"](https://github.com/coleam00/Archon/issues?q=is%3Aissue+authentication+api) — #3135 title and close date.
- [GitHub Advisory Database, query "archon"](https://github.com/advisories?query=archon) — the two Archon records (CVE-2026-111322, CVE-2025-69443) and two 2017 records for an unrelated product of the same name.
- [OX Security, CVE-2025-69443](https://www.ox.security/blog/cve-2025-69443-archon-os-vulnerable-to-unauthenticated-web-to-client-attack/) — 2026-05-12; ports 3737 and 8181, 24 exposed instances, the 2025-11-24 and 2025-12-22 timeline, no fix.
- `npm view archon-os` and `npm view @coleam00/archon` (both 404), run 2026-10-16 — no registry artifact matches the record.