Network-AI EUVD-2026-115003

Exploitation requires an A2AServer instance started via startServer() (or a programmatic mount) with no secret option configured - which is the out-of-the-box default, since secret is optional with no default and startServer() performs no fail-closed startup check. The attacker must also be able to reach the listener over the network: the default 127.0.0.1 loopback bind LIMITS exposure, so direct exploitation generally requires the operator to bind a reachable interface (the intended A2A inter-agent use case), or the attacker to use a co-located/container-network process or DNS rebinding to reach a loopback bind. If a secret is configured, the Bearer check is enforced and this bypass does not apply. The concrete downstream impact beyond creating/reading/cancelling task records depends on what the developer-supplied executor does with the attacker-controlled task text.

This is a genuine but moderate-priority issue, best characterized as a fail-open authentication default rather than a widespread emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, score 6.9) describes a network-reachable, low-complexity, unauthenticated flaw with low confidentiality, integrity, and availability impact confined to the A2A server itself - consistent with CWE-306 (missing authentication). The vuln.today decision label is 'this_month' (not act_now/emergency), and the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. No EPSS score is provided in the input, so exploitation probability cannot be quantified from this data. A detailed proof-of-concept (curl-based JSON-RPC requests) is published in the GHSA advisory, which lowers the practical barrier to exploitation, though it is not labeled as a verified packaged exploit. The key mitigating factor that CVSS does not capture is deployment context: the server defaults to binding 127.0.0.1 (loopback), so real risk hinges on whether operators expose it on reachable interfaces - which the A2A inter-agent protocol explicitly encourages. A notable tension in the evidence: the GHSA advisory body states 'Fix status: not fixed' and bounds the affected range at <= 5.15.4, while the CVE description and the reporter's closing line state the fix is in 5.15.5 - verify the actual fixed release before relying on an upgrade.

An operator deploys a Network-AI A2A agent with new A2AServer({ name, executor }).startServer(...) and, following the inter-agent networking use case, binds it to a reachable interface (e.g. 0.0.0.0) without setting the optional secret. An attacker on the network sends a JSON-RPC tasks/send request with no Authorization header; the Bearer check is skipped because no secret is configured, so the attacker-controlled task text is passed to the developer-supplied executor and executed, with results retrievable via tasks/get. A working curl-based proof-of-concept is published in the GHSA advisory.