Network-AI EUVD-2026-37787

Requires that the target runs Network-AI ≤ 5.7.1 with NETWORK_AI_MCP_SECRET unset (the documented default) and the MCP SSE server reachable by the attacker - either bound to a non-loopback interface (the pre-5.7.2 code only emits a warning, not a hard error, when binding outside 127.0.0.1), or reachable via SSRF from another local service, or invoked from a non-browser HTTP client such as curl. No user interaction, no credentials, and no special platform are required. Exploitation is limited where operators have explicitly set a non-empty NETWORK_AI_MCP_SECRET, where the server is firewalled to loopback with no SSRF reachability, or where deployments use stdio mode (--stdio) instead of the SSE transport.

CVSS 3.1 base score 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) accurately captures the severity: a network-reachable, unauthenticated, no-interaction call that yields full confidentiality and integrity loss over agent state, configuration, and tokens. EPSS, KEV, and public-POC signals are not present in the input - there is no confirmed active exploitation and no public exploit identified at time of analysis - but the GHSA advisory cites exact file paths and lines, which substantially lowers the bar for weaponization. Real-world exposure depends on deployment: instances bound to loopback with no SSRF reachability are practically low-risk, while any container, VM, or developer workstation that binds the SSE server to 0.0.0.0 (which the code only warns about, not blocks, prior to 5.7.2) is fully exposed. Treat this as a high priority for any user running an unset NETWORK_AI_MCP_SECRET.

An attacker identifies a developer or CI host running Network-AI with NETWORK_AI_MCP_SECRET unset and the SSE server bound to a non-loopback interface (or reachable via SSRF in a co-located web app). With a single unauthenticated HTTP POST carrying a JSON-RPC frame, the attacker calls config_set to point the orchestrator at attacker-controlled endpoints, then agent_spawn to execute agent tasks and blackboard_write to inject crafted context, exfiltrating tokens via the token_* tools. No public POC is referenced, but the GHSA advisory pinpoints bin/mcp-server.ts:89 and lib/mcp-transport-sse.ts:254/:272/:367-368, providing the exact RPC entry path.