Logo
Retour à la veille

CVE-2026-111322

Publié : 15 octobre 2026
Modifié : 15 octobre 2026
Lien officiel NVD
Score CVSS
9.8
CRITICAL

Description détaillée

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://github.com/coleam00/Archonhttps://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/index.ts#L909https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-defaulthttps://www.vulncheck.com/advisories/archon-0.2.13-through-0.11.1-missing-authentication-via-api-control-api

Dernières Vulnérabilités

CVE-2026-111389

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.

VOIR DÉTAILS

CVE-2026-111388

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.

VOIR DÉTAILS

CVE-2026-111387

Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.

VOIR DÉTAILS