What is the CVSS score of CVE-2026-58482?

CVE-2026-58482 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-58482?

Yes, a patch is available for CVE-2026-58482. Update the affected software to the latest version immediately.

Network-AI CVE-2026-58482

EUVD-2026-46020 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-20 GitHub_M

CSRF SSRF Node.js Network Ai Jovancoding

5.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

vuln.today AI

5.9 MEDIUM

Wildcard CORS CSRF path requires operator browser visit (UI:R, AC:H); non-loopback binding enables direct PR:N/UI:N exploitation scored separately at 8.1.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 20, 2026 - 18:24 vuln.today

Analysis Generated

Jul 20, 2026 - 18:24 vuln.today

Patch available

Jul 20, 2026 - 18:18 EUVD

DescriptionCVE.org

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called ApprovalInbox (lib/approval-inbox.ts). It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets Access-Control-Allow-Origin: * on every route, including the state-changing POST /approvals/:id/approve and /deny. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port - a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) - can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. ApprovalInbox now accepts a secret option. When set, the mutating endpoints POST /:id/approve and POST /:id/deny require an Authorization: Bearer <secret> header, validated in constant time with crypto.timingSafeEqual. startServer() already binds to 127.0.0.1 by default; operators exposing the inbox on a network must set a secret.

AnalysisAI

Unauthenticated access to the ApprovalInbox HTTP server in Network-AI 5.0.0-5.12.1 allows any party that can reach the inbox port to enumerate pending agent approvals and approve or deny them without operator consent, completely defeating the human-in-the-loop Approval Gate designed to gate high-risk operations such as shell commands and file writes. Exploitation via CSRF is possible against the default 127.0.0.1 binding because the server unconditionally sets Access-Control-Allow-Origin: * on all routes, including state-changing POST endpoints, enabling any website the operator visits to silently submit approval requests through their browser. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available as of v5.12.2.

Technical ContextAI

Network-AI is a TypeScript/Node.js multi-agent orchestrator (npm package network-ai, CPE: cpe:2.3:a:jovancoding:network-ai:*:*:*:*:*:*:*:*) that provides shared state, guardrails, budgets, and cross-framework agent coordination. Its ApprovalGate component is documented as the mechanism for requiring explicit human approval before executing high-risk operations - writes, shell commands, and budget spend. The network surface for this control is ApprovalInbox (lib/approval-inbox.ts), which exposes a REST/SSE HTTP server. The root causes are CWE-352 (Cross-Site Request Forgery) and CWE-862 (Missing Authorization): the httpHandler() function sets Access-Control-Allow-Origin: * on every response unconditionally, and routeRequest() dispatches POST /approvals/:id/approve and POST /approvals/:id/deny without any authentication check. This is described in the GHSA advisory as the same vulnerability class already fixed twice on the MCP server component (GHSA-fj4g-2p96-q6m3, GHSA-j3vx-cx2r-pvg8) that was never applied to the auxiliary ApprovalInbox server.

RemediationAI

Upgrade to network-ai v5.12.2, confirmed by the vendor release at https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2 and patch commit https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3. The fix adds a secret option to ApprovalInbox; when set, POST /:id/approve and POST /:id/deny require an Authorization: Bearer <secret> header validated with crypto.timingSafeEqual to prevent timing-attack recovery of the secret. Operators who cannot patch immediately should verify that startServer() is bound exclusively to 127.0.0.1 (the default) to eliminate direct remote network access - note this does not prevent the CSRF path via a malicious webpage, so this workaround is incomplete. As an additional control, restrict network-level access to the inbox port via host firewall rules (e.g., iptables/nftables dropping inbound traffic to the inbox port) to block both direct and SSRF-based exploitation; this has no functional side effect if only the operator's own browser needs access. Disabling the ApprovalGate/ApprovalInbox feature entirely removes the attack surface but also eliminates the human-in-the-loop safety control for high-risk agent operations.