Network-AI CVE-2026-109330

Exploitation requires that the victim is actively running the Network-AI DashboardServer (the loopback dashboard) AND is lured into visiting an attacker-controlled web page in a browser on the same host (UI:P). The specific enabling flaw is that handleUpgrade performs no Origin header check and no token/authentication check on the WebSocket upgrade, so any cross-origin page can connect. Limiting factors: the dashboard component must be running at the time of the attack, the victim must load the malicious page, impact is read-only recon of agent topology (no write or disruption), and only versions 5.0.0 up to (not including) 5.15.2 are affected - upgrading to 5.15.2 removes the condition.

This is a medium-severity information-disclosure issue (CVSS 4.0 base 5.3) whose real-world risk is modest. The CVSS 4.0 vector confirms network reach (AV:N), low attack complexity (AC:L), no privileges (PR:N), but passive user interaction (UI:P) - the victim must already be running the Network-AI dashboard locally and then visit an attacker-controlled page. Impact is confidentiality-only and rated low (VC:L, with VI:N/VA:N), consistent with CWE-1385 (missing standard security check / cross-site WebSocket hijacking): the attacker reads live agent topology (agent IDs, roles, task descriptions, token budgets) but cannot modify or disrupt anything. No EPSS score, KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent (no CVSS-vs-description conflict), so there is no high-urgency flag here: this is a legitimate privacy/recon weakness but not a widespread-exploitation priority, especially given the niche product footprint and the UI requirement that bounds mass exploitation.

An attacker hosts a malicious web page and lures a user who is running the Network-AI dashboard on their machine into visiting it. Because DashboardServer's handleUpgrade validates neither the Origin header nor a token, the page silently opens a WebSocket back to the victim's loopback dashboard and streams out agent IDs, roles, task descriptions, and token budgets. No public exploit code was identified in the provided data; exploitation is cross-origin and low-complexity but requires the victim to actively load the attacker's page.