EUVD-2026-37787
GHSA-r78r-rwrf-rjwp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable SSE endpoint, no auth required by default, no user interaction; full read/write of agent config, blackboard, and tokens gives C:H/I:H, no direct availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP SSE server allows unauthenticated cross-origin MCP tool invocation due to an empty default secret. This issue was partially addressed by CVE-2026-46701 in version 5.4.5 by closing the CORS flaw (with Access-Control-Allow-Origin now set only for localhost origins), but the empty-default-secret flaw described in the title remained: the SSE MCP server still defaulted to an empty secret, _isAuthorized() still returned true when the secret was empty, and a non-loopback bind only produced a warning. As a result, the server still ran fully unauthenticated by default. Any non-browser caller (for example, curl, SSRF, or a 0.0.0.0 bind) could invoke all 22 MCP tools (config_set, agent_spawn, blackboard_write, token_*) with no credentials. This issue was fixed in version 5.7.2.
Articles & Coverage 2
AnalysisAI
Authentication bypass in Network-AI versions 5.7.1 and earlier allows unauthenticated remote attackers to invoke all 22 MCP tools on the SSE server because the default secret is empty and _isAuthorized() returns true when no secret is configured. Despite the partial fix for CVE-2026-46701 in 5.4.5 (which restricted CORS to localhost origins), any non-browser caller - curl, SSRF, or a service exposed via a 0.0.0.0 bind - can still call privileged operations like config_set, agent_spawn, blackboard_write, and token management with zero credentials. No public exploit identified at time of analysis, but the GHSA advisory includes annotated source-code locations that effectively serve as a roadmap for exploitation.
Technical ContextAI
Network-AI is a Node.js/TypeScript multi-agent orchestrator that exposes a Model Context Protocol (MCP) server-sent-events transport (lib/mcp-transport-sse.ts) to let MCP clients drive agent operations over HTTP. The CLI entrypoint (bin/mcp-server.ts:89) reads process.env['NETWORK_AI_MCP_SECRET'] ?? '', so when the environment variable is unset the constructor receives an empty string. The _isAuthorized() guard at lib/mcp-transport-sse.ts:254 short-circuits to true whenever this._opts.secret is falsy, mapping directly to CWE-306 (Missing Authentication for Critical Function). Affected library: npm/network-ai per CPE cpe:2.3:a:jovancoding:network-ai:*:*:*:*:*:*:*:*. The earlier CVE-2026-46701 patch only addressed the wildcard Access-Control-Allow-Origin: * browser exposure; the underlying credential check was never made fail-closed until 5.7.2.
RemediationAI
Vendor-released patch: 5.7.2 - upgrade with npm install network-ai@5.7.2 (release notes: https://github.com/Jovancoding/Network-AI/releases/tag/v5.7.2). In 5.7.2 _isAuthorized() fails closed when the secret is empty, and McpSseServer.listen() now throws an Error rather than warning when secret is empty, preventing accidental open deployments; any caller that instantiates McpSseServer directly from lib/ must now pass a non-empty secret. If you cannot upgrade immediately, set NETWORK_AI_MCP_SECRET to a strong random value (this satisfies the pre-5.7.2 guard) and bind the SSE listener to 127.0.0.1 only - note that an exposed bind paired with a configured secret still leaves you reliant on the unchanged transport, and SSRF from a co-located service can still reach loopback. As a stronger compensating control, switch to stdio mode (--stdio) for Claude Desktop/Cursor/Glama integrations since McpSseServer is not used in that path; trade-off is loss of network-reachable MCP clients.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Share
External POC / Exploit Code
Leaving vuln.today