Network-AI CVE-2026-109332

Exploitation requires that the McpSseServer in lib/mcp-transport-sse.ts be bound to a non-loopback address (a non-default, operator-chosen deployment such as 0.0.0.0 rather than 127.0.0.1); against a default loopback bind the flaw is not remotely reachable. It further requires victim user interaction (UI:P) - the victim must visit an attacker-controlled page that can reach the server's network location - and the exposure is limited to unauthenticated endpoints like /health, so only low-sensitivity information is disclosed. No authentication is needed by the attacker (PR:N), but the non-default bind and required victim browsing substantially constrain realistic exploitation.

This is a genuinely low-priority issue, and the signals are consistent in that direction. The only provided CVSS is a 4.0 vector scoring 2.3 (Low): AV:N but AT:P (a specific attack requirement - the server must bind a non-loopback interface) and UI:P (a victim must visit an attacker-controlled page), with only VC:L confidentiality impact and no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vulnerability is a CORS origin-validation flaw (CWE-346) that leaks only unauthenticated, low-sensitivity endpoints such as /health cross-origin. Multiple limiting factors (non-default bind configuration, required victim interaction, and trivial data exposure) all compound to keep real-world risk minimal. No conflicting signals are present; the chief caveat is simply the thin intelligence set - a single vendor/VulnCheck advisory with no exploitation telemetry.

An operator runs network-ai with its MCP SSE server bound to a non-loopback address (e.g., 0.0.0.0). An attacker lures a victim who has network reach to that server into visiting a malicious web page; the page issues a cross-origin request with a localhost Origin, which the server reflects into Access-Control-Allow-Origin, letting the attacker's JavaScript read responses from unauthenticated endpoints like /health. No public exploit code was identified at time of analysis.