Archon, JuggleIM, Agora Project: Three Self-Hosted Tools at 9.8, an AI Agent API Open to Anyone

Three CVEs rated 9.8, published by NVD between October 13 and 15, 2026, in three tools you install yourself: Archon, a platform driving an AI coding agent; JuggleIM im-server, an instant messaging server; and Omnispace Agora Project, a PHP collaborative workspace.

The common thread: administrative functions reachable from the network with no real authentication. In all three cases the outcome is the same — the attacker takes over the tool, and often the machine.

All three: CVSS 3.1 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, none in CISA KEV as of writing.

Archon — CVE-2026-111322: an Exposed AI Agent Is a Remote Shell

Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host

This is the most telling flaw of the batch, and we'll see more like it as AI agent tooling spreads.

Archon exposes a control API with no authentication, and that API listens on all interfaces by default (0.0.0.0), not just locally. Behind it, the AI coding agent runs in bypassPermissions mode: it carries out requested actions without asking for confirmation.

Put together: anyone who can reach the port can send instructions to the agent, which runs them on the host with the Archon user's privileges. No sophisticated exploit needed — the agent does exactly what it was built to do, just for the wrong person.

What that means in practice:

• access to the source code and repositories the agent works on;
• access to secrets present in the environment: model provider API keys, Git tokens, cloud credentials;
• command execution on the machine, with everything the Archon user can reach.

A developer laptop on shared Wi-Fi, a cloud VM with a public IP: either is enough.

Versions: NVD bounds it from 0.2.13 to 0.11.1 and names no fixed version. Check the project repository.

Actions:

1. Bind the API to 127.0.0.1 if the configuration allows it, or block the port in the host firewall.
2. Never expose the API on a public IP; use an SSH tunnel or VPN for remote access.
3. Run the agent in an isolated environment (container, dedicated VM), with no production secrets, and without bypassPermissions unless it's truly needed.
4. If it was exposed: rotate the API keys and tokens on the host, and review the agent's action history.

JuggleIM im-server — CVE-2026-111329

JuggleIM im-server ships with documented default administrator credentials. A classic — with a twist: deleting the account doesn't help, because the server recreates it automatically at login.

Once in, the attacker controls tenant applications and their app secrets: they can impersonate any client application of the messaging service.

Versions: NVD bounds it at 1.8.16 inclusive, with no fixed version published.

Actions:

1. Don't expose the admin console: restrict it to the local network or a VPN at the firewall.
2. Change the administrator password, then check that the default credentials are actually rejected — don't rely on deleting the account, which is ineffective here.
3. Rotate tenant app secrets if the console was reachable from outside.
4. Watch the project repository for a fixed release.

Omnispace Agora Project — CVE-2026-63146

Two defects combined. An SQL injection makes it possible to re-run the installer, and that installer writes unescaped values into the PHP configuration file. Result: unauthenticated remote code execution.

A useful reminder: a web installer that stays reachable after installation is one more admin function, and usually the least protected one.

Versions: NVD states the fix is in 26.10.0.

Actions:

1. Upgrade to 26.10.0.
2. Check the configuration file (config.inc.php): modification date, unexpected content.
3. Make the configuration read-only for the web server user once installation is done, and block access to the installer.

Shared Detection

• Listening ports: ss -tlnp (or equivalent) on each host — any admin service bound to 0.0.0.0 needs a justification.
• External scan of your public IPs to spot these exposed interfaces.
• Unexpected child processes of the Archon, JuggleIM or PHP services.
• Admin logins from IPs outside your admin network.

Why Continuous Monitoring of Your Self-Hosted Tools Matters

These tools often arrive through a docker run or git clone on a laptop or VM, outside any inventory. They listen on every interface because it's easier to get started, and nobody comes back to it. With AI agents, that shortcut hands out a shell.

With cveo.tech, add these tools to your inventory too and get alerted whenever a critical CVE hits them.