Network-AI ClaudeHookBridge CVE-2026-73614

Exploitation requires low-privilege access (PR:L per the CVSS 4.0 vector) sufficient to submit Bash command fields through the ClaudeHookBridge interface - unauthenticated external attackers cannot exploit this directly. The vulnerable code path is active specifically when operator-defined denyPatterns are configured and relied upon as a security enforcement boundary; environments without denyPatterns have no control to bypass, though they also have no protection against arbitrary commands. The bypass is effective against any Bash command field that accepts input exceeding 500 characters in total length, placing the malicious payload past the truncation boundary. Exploitation is limited to deployments of Network-AI ClaudeHookBridge on versions prior to 5.15.1. The primary limiting factor is the PR:L access requirement - exploitation cannot occur without first obtaining authenticated or lower-trust access to the bridge's command submission interface.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately characterizes a network-reachable, low-complexity bypass that produces full-impact RCE on the vulnerable system; the SC:N/SI:N/SA:N metrics indicate no additional subsequent-system scope change is modeled. EPSS data was not present in available intelligence, and the vulnerability does not currently appear in CISA KEV, leaving exploitation probability unquantified - though the near-zero technical complexity (AC:L, AT:N) means any threat actor with PR:L access could exploit this without specialized tooling. Even a mid-sized municipal IT team in sopot relying on denyPatterns as a hard enforcement boundary should treat this as urgent, since the bypass completely nullifies that control layer. The primary risk moderator is the PR:L requirement: unauthenticated external attackers cannot exploit this directly, and the realistic threat surface is constrained to insiders, compromised low-privilege accounts, or multi-step attack chains where bridge access is obtained as an intermediate step.

An attacker with low-privilege access to the ClaudeHookBridge submission interface crafts a Bash command string where 500 characters of benign-looking content precede a malicious payload - such as a reverse shell invocation or credential exfiltration command - appended at byte 501 and beyond. When submitted, the bridge evaluates only the innocuous prefix against the operator's denyPatterns, finds no violation, and permits execution; Claude Code then runs the complete string, triggering the hidden payload. No public proof-of-concept has been identified at time of analysis, but the technique requires no specialized tooling beyond the ability to construct a sufficiently long command string.