DEV Community

CortexFlow
CortexFlow

Posted on Originally published at cortexflow.tech

Archon's Agent Control API Has No Login and Listens on Every Interface: The CVE-2026-111322 Lockdown Guide

#archon #cve #security #aicodingagents

On October 15, 2026, VulnCheck published CVE-2026-111322 against Archon, the open-source workflow engine behind Claude Code, Codex, and Pi. The finding is brutally simple: in a default install, Archon's /api/* control API has no authentication, and the server binds to 0.0.0.0 — every network interface.

That matters because this API is not a status page. It starts workflow runs, injects messages into agent conversations, and approves or rejects the actions your AI coding agent paused on for human review. Anyone on your network can do all of that with no credential. By the end of this guide you will have a locked-down Archon install — in about 10 minutes, with zero code changes.

What Archon Is, in One Line

Archon (23,700+ stars on GitHub) is an open-source engine that drives AI coding agents through YAML-defined development workflows. You run archon serve, and a web console lets you watch the agent work, talk to it, and approve the actions it pauses on. That console talks to the HTTP control API at the center of this CVE.

The Finding, Precisely

Security researcher hieuPenguinnn pinned the root cause to three facts in the Archon OS server package (reviewed at release tag v0.11.1, published 2026-09-25):

  1. The server binds to all interfaces by default. packages/server/src/index.ts sets the bind host to process.env.HOST || '0.0.0.0', and the shipped .env.example confirms the default port is 3090. A default install is network-reachable on port 3090.
  2. The API gate is disabled by default. The /api/* middleware only enforces authentication when isApiGateEnabled() is true — which requires both a Postgres DATABASE_URL and a BETTER_AUTH_SECRET. A default install uses SQLite and sets neither, so every request passes through with no identity check.
  3. The mutating routes are the agent control plane. Behind that disabled gate: start workflow runs (POST /api/workflows/{name}/run), inject conversation messages, approve/reject paused agent actions, and connect/disconnect provider keys.

The one-line version: anyone who can reach port 3090 on your machine can drive your AI coding agent. The CVE carries CWE-306 (missing authentication for critical function) plus CWE-862, CVSS 9.8 (v3.1) / 9.3 (v4.0). Affected: versions 0.2.13 through 0.11.1. As of October 16, 2026, the latest release is still v0.11.1 — there is no vendor patch and no published advisory.

One honest caveat from the researcher's own writeup: he did not establish direct remote code execution on the host from source review alone — the provider-key list route returns metadata only, and the damage a driven run can do depends on the workflows and agent configured. VulnCheck scores it 9.8 because the agent plane is reachable and these agents run commands. Treat it as critical either way.

A programmer typing code on a laptop, representing the AI coding agent running on the developer's machine

The agent runs on your machine with your permissions. Its control plane should not be network-open.

Prerequisites

  • SSH or terminal access to the machine running archon serve
  • Your Archon .env file (or however you set its environment variables)
  • About 10 minutes

Example terminology: <your-host> is the machine running Archon. Port 3090 is the default from the shipped .env.example — replace it if you changed it.

Step 1 - Check Whether You Are Affected

Check your Archon version first. If it falls between 0.2.13 and 0.11.1 inclusive, you are running affected code:

# inside your Archon checkout or container
git describe --tags 2>/dev/null || grep -m1 '"version"' package.json
Enter fullscreen mode Exit fullscreen mode

Then check your config. You are exposed when all three are true: no HOST set to 127.0.0.1, no Postgres DATABASE_URL, and no BETTER_AUTH_SECRET:

grep -E '^(HOST|PORT|DATABASE_URL|BETTER_AUTH_SECRET)' .env
Enter fullscreen mode Exit fullscreen mode

Missing lines mean defaults apply: HOST=0.0.0.0, SQLite, no auth. That is the vulnerable posture — and it is the shipped default. (Note: this is a different defect from CVE-2025-69443, which concerned Archon's archived Python backend.)

Step 2 - Check What the API Is Actually Bound To

Do not trust the config file alone — check the listening socket:

ss -tlnp | grep 3090
Enter fullscreen mode Exit fullscreen mode

You should see one line. If it reads 0.0.0.0:3090, the control API is reachable from your entire network. If it reads 127.0.0.1:3090, the network reach is already gone and you can skip to Step 5.

Warning: localhost in a URL does not mean the server is loopback-only. Plenty of setups proxy through a tunnel while the underlying server still sits on 0.0.0.0. The ss output is the ground truth.

Step 3 - Bind the Server to Loopback

This is the single highest-leverage fix. The shipped .env.example documents it explicitly:

# HOST=0.0.0.0 # Bind address (default: 0.0.0.0). Set to 127.0.0.1 to restrict to localhost only.
# PORT=3090 # Default: 3090.
Enter fullscreen mode Exit fullscreen mode

Set it in your .env (create the file if you do not have one):

HOST=127.0.0.1
Enter fullscreen mode Exit fullscreen mode

Restart the server, then re-run Step 2. You should now see 127.0.0.1:3090 — other hosts on your network can no longer reach the API at all, even though the auth gate is still disabled. The researcher confirms this removes the network reach entirely.

Step 4 - Block the Port at the Firewall

Bind config is one layer; the firewall is the second. Deny inbound traffic to 3090 from anywhere except the local machine:

# Ubuntu/Debian with ufw
sudo ufw deny 3090
Enter fullscreen mode Exit fullscreen mode

ufw deny 3090 blocks inbound connections to that port from all interfaces. Loopback traffic from your own machine still reaches 127.0.0.1:3090, so the web console keeps working locally. If you run Archon in Docker with published ports, remove the -p 3090:3090 mapping and use --network host or container-to-container networking instead — a published port re-opens the door the bind config just closed.

Step 5 - If You Need Network Access, Enable Web Auth

Only do this step if you genuinely need to reach Archon from other machines. The supported way to arm the auth gate is to set both a Postgres database URL and a secret:

DATABASE_URL=postgresql://<user>:<password>@<host>:5432/archon
BETTER_AUTH_SECRET=<generate-a-long-random-string>
Enter fullscreen mode Exit fullscreen mode

Generate the secret with openssl rand -hex 32 — never reuse one from another service. With both set, isApiGateEnabled() returns true and the middleware enforces a 401 on non-allowlisted /api/* routes. If that migration is too heavy right now, keep Step 3 and 4 and put a reverse proxy with basic auth in front of Archon instead. Never expose port 3090 directly to the internet or an untrusted network.

Step 6 - Verify Everything Works

Three checks, in order:

# 1. Loopback still answers
curl -s http://127.0.0.1:3090/api/health

# 2. Nothing listens on the external interface
ss -tlnp | grep 3090   # expect 127.0.0.1:3090 only

# 3. The web console loads locally
# open http://127.0.0.1:3090 in your browser
Enter fullscreen mode Exit fullscreen mode

If check 1 succeeds and check 2 shows only the loopback line, the lockdown holds: the agent control plane is reachable from your machine and nowhere else.

Code on a dark screen, representing the control API that should stay off the network

The fix is three lines of config and one firewall rule — not a patch, because none exists yet.

FAQ

Am I safe if I only use Archon on my laptop?

Probably — if nothing else on your network can reach it. "Probably" is not a control, though: run Step 2 and confirm 127.0.0.1:3090. Coffee-shop Wi-Fi and office LANs are exactly the networks where an open 0.0.0.0 bind hurts.

Is this the same as the old Archon Python CVE?

No. CVE-2025-69443 concerned the archived Python backend. CVE-2026-111322 is in the TypeScript Archon OS server line — a separate defect in a separate codebase.

Has Archon patched it?

Not yet. As of October 16, 2026 there is no public advisory for this defect and the latest release (v0.11.1, from September 25) is still affected. Watch the coleam00/Archon releases page for a version that changes the default bind host or adds auth — keep the lockdown until then.

Does this affect n8n too?

No — this is Archon-specific. But the pattern is worth auditing everywhere: any agent tool you run (archon serve, local LLM servers, MCP servers) that binds 0.0.0.0 by default is the same class of mistake. Grep your running services with ss -tlnp and question every 0.0.0.0.

Limits and What I Did Not Test

I did not spin up Archon and execute requests against a live instance here — the findings above come from VulnCheck's advisory (October 15, 2026) and the researcher's pinned source review at v0.11.1, both of which agree on the three root-cause facts. The mitigation steps are config-level and low-risk, but back up your .env before editing. And this lockdown fixes the network reach — it does nothing about prompt injection, malicious plugins, or supply-chain attacks on the agent itself, which are separate problems with their own fixes.

Key Takeaways

  1. CVE-2026-111322 is a missing-authentication flaw (CVSS 9.8) in Archon 0.2.13–0.11.1: the /api/* control API has no login and binds to 0.0.0.0:3090 by default.
  2. The shipped default is the vulnerable posture — the auth gate only arms with both a Postgres DATABASE_URL and a BETTER_AUTH_SECRET, which a default SQLite install never sets.
  3. Set HOST=127.0.0.1 and firewall port 3090 — two changes that remove the network reach entirely, verified with ss -tlnp.
  4. No vendor patch exists as of October 16, 2026 — keep the lockdown until a release notes an auth fix.
  5. Audit your other agent tools for the same pattern — any local server binding 0.0.0.0 by default is this bug waiting for a CVE number.

Next step: if you run AI coding agents, read our Plugin4Shell breakdown — a separate zero-click flaw where a pinned plugin commit turned out to be a lie. And if you self-host n8n, our exposed-instances hardening checklist covers the same bind-and-expose pattern for automation infrastructure.

Images: Pexels

Originally published on CortexFlow. Free n8n templates: https://cortexflow.tech/templates/

Top comments (0)