Unverified50% confidenceSolutionExact time
Before the fix, the vulnerability could be mitigated by setting the environment variable HOST=127.0.0.1 to bind Archon to the loopback address.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/16/2026
First Seen
Valid until: 1/14/2027
Sources
Related Entities
Related Claims
UnverifiedPreviously, OX Security disclosed CVE-2025-69443 in the Archon OS product line (0.1.0 to 0.3.11), where a backend port with neither CORS protection nor authentication could be accessed by a malicious webpage.65% similarUnverifiedSecurity firm Rapid7 patched a related low-severity vulnerability last month.51% similarUnverifiedOnce the private key file hs_ed25519_secret_key is lost, the corresponding .onion address can never be recovered.51% similarUnverifiedBecause iroh uses public key addressing, when a device changes networks it only needs to republish reachable paths, and the peer can rebuild the connection using the public key, which is why Flipflop's persistent tunnel can survive network changes.51% similarUnverifiedIf Grok CLI has ever been used in an affected directory, all keys, passwords, and tokens in .env should be rotated immediately.51% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1043099API
curl https://kongchang.com/api/v1/knowledge/claims/1043099MCP
get_claim(id=1043099)