Which versions of Network-AI are affected by CVE-2026-64622?

The Network-AI npm package (versions 5.12.2-5.13.3) contains an unauthenticated vulnerability that exposes sensitive approval-workflow data-including pending shell commands, file paths, and risk…

How to fix or mitigate CVE-2026-64622?

Within 24 hours: Conduct an inventory of all systems using the Network-AI npm package versions 5.12.2-5.13.3 and restrict network access to affected instances to trusted administrative networks only. Within 7 days: Implement a reverse-proxy layer with enforced authentication in front of the ApprovalInbox endpoint, or disable the vulnerable GET read routes entirely; review approval request logs for signs of unauthorized access. Within 30 days: Monitor for a vendor patch release; upon availability, test and deploy the patched version across all environments, and conduct a security audit of approval decisions made during the vulnerability window.

Network-AI CVE-2026-64622

Q: What is the CVSS score of CVE-2026-64622?

CVE-2026-64622 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-45937 CRITICAL

Missing Authorization (CWE-862)

2026-07-20 disclosure@vulncheck.com

GHSA-xvgx-9rph-3pj6

Authentication Bypass Node.js

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network GET routes ignore the configured secret (AV:N/AC:L/PR:N/UI:N); impact is disclosure of sensitive approval data only, so C:H with I and A none.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 12:41 vuln.today

CVE Published

Jul 20, 2026 - 12:19 cve.org

CRITICAL 9.3

DescriptionCVE.org

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.

Articles & Coverage 1

News Critical Information Disclosure in Node.js network-ai Package - CVE-2026-64622 Jul 20, 2026

AnalysisAI

Unauthenticated information disclosure in the Network-AI (npm: network-ai) package versions 5.12.2 through 5.13.3 lets remote actors read the ApprovalInbox even when an operator has configured a checkAuth/secret, because the authorization check was never wired into the GET read routes. Exploitation exposes full approval-request content - including pending shell-command strings, file paths, justifications, and risk levels - and a hardcoded Access-Control-Allow-Origin:* header allows any website an operator visits to exfiltrate the same data cross-origin. This is an incomplete fix for GHSA-mxjx-28vx-xjjj; no public exploit is identified at time of analysis and the package is not listed in CISA KEV.

Technical ContextAI

Network-AI is a Node.js library that implements a human-in-the-loop approval workflow (an 'ApprovalInbox') for AI-agent actions, where proposed operations such as shell commands and file writes are queued as ApprovalEntry records for an operator to approve or reject. The root cause is CWE-862 (Missing Authorization): the configured checkAuth/secret guard is applied to some routes but was omitted on the read paths GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse, so the server serves sensitive entry content without evaluating the operator's secret. The problem is compounded at the HTTP layer by a hardcoded Access-Control-Allow-Origin: * response header, which disables the same-origin protection browsers would normally enforce, so a malicious page loaded in the operator's browser can issue cross-origin fetches (including to the SSE stream) and read the responses.

RemediationAI

Upgrade the network-ai npm package to a release later than 5.13.3 that applies the checkAuth/secret guard to all ApprovalInbox GET routes; the input data does not include an exact fixed version, so consult the GHSA-m4jg-6w3q-gm86 advisory (https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-m4jg-6w3q-gm86) and the VulnCheck advisory (https://www.vulncheck.com/advisories/network-ai-through-missing-authorization-via-approvalinbox) for the patched version before deploying, and do not assume the prior GHSA-mxjx-28vx-xjjj fix is sufficient because this CVE is explicitly an incomplete fix for it. Until a patched build is confirmed, place the ApprovalInbox behind a reverse proxy or network ACL that enforces authentication on GET /approvals/, /approvals/:id, /approvals/stats, and /approvals/sse (trade-off: the app's own secret is bypassed, so the proxy becomes the sole gate), bind the service to localhost or a trusted interface instead of a public address, and strip or restrict the Access-Control-Allow-Origin:* header at the proxy to a specific trusted origin to block cross-origin browser-based theft (trade-off: legitimate cross-origin dashboards will break and must be explicitly allowlisted).