Network-AI CVE-2026-58482

The CSRF path (the lower 5.9 CVSS score) requires: (1) the target application uses ApprovalGate/ApprovalInbox - this is not enabled by default in all network-ai deployments, only when operators explicitly configure human-in-the-loop gates; (2) at least one approval is pending in the queue at the time of attack, providing a valid approval ID; (3) the operator visits a malicious webpage while the inbox server is running. The direct network path (8.1 High) instead requires: the operator to have configured startServer() to bind a non-loopback address, or an attacker to have SSRF access from another service on the same host, or co-located process access - none of these are default. In both paths, no authentication whatsoever is required by the server. Exploitation is limited by the requirement that ApprovalInbox be actively deployed and that a pending approval exist; it is not a standing persistent attack surface unless the feature is in continuous use.

The provided CVSS 3.1 score of 5.9 Medium (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N) models the CSRF path against the default 127.0.0.1 binding - the high complexity (AC:H) and required user interaction (UI:R) reflect the social engineering step of luring the operator to a malicious page. However, the GHSA advisory explicitly documents a second, more severe scenario (AV:N/AC:L/PR:N/UI:N = 8.1 High) applicable when the operator binds the inbox to a non-loopback address, or when an attacker has SSRF or co-located process access - in those cases exploitation is direct, unauthenticated, and requires no interaction. The real-world integrity impact is significant beyond what the base score conveys: the compromised control is specifically the last line of defense before an AI agent executes a high-risk action, so successful exploitation results in arbitrary agent-authorized command execution rather than mere data manipulation. No EPSS score was provided in the input data, and no CISA KEV listing exists, meaning exploitation in the wild is neither confirmed nor quantified. The absence of a public POC does not substantially lower risk given the trivial constructability of a CSRF payload.

An attacker hosts a webpage containing JavaScript that issues a fetch() or XMLHttpRequest POST to http://127.0.0.1:<inbox_port>/approvals/<known-or-guessed-id>/approve; because ApprovalInbox sets Access-Control-Allow-Origin: * with no preflight restriction, the operator's browser sends the request when they visit the page, silently approving a pending shell command or write operation the AI agent had queued for review. No public proof-of-concept code has been identified, but the attack is constructable with fewer than ten lines of standard browser JavaScript given knowledge of the inbox port and any pending approval ID.