Read the docs
TI-2026-34330 Aliases CVE-2026-46701GHSA-j3vx-cx2r-pvg8

Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

Priority LOW 33CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.

Summary

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''` at `bin/mcp-server.ts:89`), which causes `_isAuthorized` (`lib/mcp-transport-sse.ts:254`) to return `true` unconditionally for every request — no `Authorization` header is required. Simultaneously, `_handleRequest` sets `Access-Control-Allow-Origin: *` (`lib/mcp-transport-sse.ts:272`) on every response, so a cross-origin browser fetch can read the result without restriction. An unauthenticated attacker who can lure a user to a malicious web page can invoke all 22 exposed MCP tools — including `config_set`, `agent_spawn`, and `blackboard_write` — against a default-configured localhost server. Version 5.4.5 patches the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0021 11th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Network-AI (Jovancoding): 5.4.5network-ai (npm): 5.4.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JovancodingNetwork-AIbefore 5.4.55.4.5Patch availableCNA
—network-ai (npm)before 5.4.55.4.5Patch availableGHSA-j3vx-cx2r-pvg8
  • Network-AI VendorJovancoding Affected before 5.4.5 Fixed in 5.4.5 Patch available CNA
  • network-ai (npm) Vendor— Affected before 5.4.5 Fixed in 5.4.5 Patch available GHSA-j3vx-cx2r-pvg8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:network-ai:network-ai:*:*:*:*:*:*:*:*before 5.4.5VulnerableJovancoding
  • cpe:2.3:a:network-ai:network-ai:*:*:*:*:*:*:*:* Versions before 5.4.5 Vulnerable ·Jovancoding

Remediation

  • Fix · CNA Network-AI (Jovancoding) Fixed in 5.4.5
  • Fix · GHSA-j3vx-cx2r-pvg8 network-ai (npm) Fixed in 5.4.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46701
  2. 2026-10-03 Alias added: GHSA-j3vx-cx2r-pvg8

References

Exploit 1

Patch 2

Other 1

  • TI-2026-42088 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning CVSS 3.1HIGH 7.1
  • TI-2026-42085 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory CVSS 3.1MEDIUM 6.5
  • TI-2026-42086 Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions CVSS 3.1MEDIUM 5.9
  • TI-2026-42024 EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data CVSS 3.1MEDIUM 6.1
  • TI-2026-42025 Path traversal in Jovancoding Network-AI CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences