Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-46701

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''` at `bin/mcp-server.ts:89`), which causes `_isAuthorized` (`lib/mcp-transport-sse.ts:254`) to return `true` unconditionally for every request — no `Authorization` header is required. Simultaneously, `_handleRequest` sets `Access-Control-Allow-Origin: *` (`lib/mcp-transport-sse.ts:272`) on every response, so a cross-origin
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:8435f65fdac3f0f8c06014ecf37babe30063022ccdf688d43c795f05675ffe22
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"Network-AI","vendor":"Jovancoding","versions":[{"status":"affected","version":"< 5.4.5"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:ec468ea09bcf771b14582736fed1d137de45315788cd867f97341050d85ac083 · sha256:12ea10a1951b0625… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:ec468ea09bcf771b14582736fed1d137de45315788cd867f97341050d85ac083 · sha256:12ea10a1951b0625… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-346","description":"CWE-346: Origin Validation Error","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ec468ea09bcf771b14582736fed1d137de45315788cd867f97341050d85ac083 · sha256:12ea10a1951b0625… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"https://github.com/Jovancoding/Network-AI/commit/dc5048112283f3f4eb6c06dd2bf5aa93ef9339be","tags":["x_refsource_MISC"],"url":"https://github.com/Jovancoding/Network-AI/commit/dc5048112283f3f4eb6c06dd2bf5aa93ef9339be"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ec468ea09bcf771b14582736fed1d137de45315788cd867f97341050d85ac083 · sha256:12ea10a1951b0625… · /containers/cna/references/1
{"name":"https://github.com/Jovancoding/Network-AI/releases/tag/v5.4.5","tags":["x_refsource_MISC"],"url":"https://github.com/Jovancoding/Network-AI/releases/tag/v5.4.5"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ec468ea09bcf771b14582736fed1d137de45315788cd867f97341050d85ac083 · sha256:12ea10a1951b0625… · /containers/cna/references/2
{"name":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-j3vx-cx2r-pvg8","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-j3vx-cx2r-pvg8"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ec468ea09bcf771b14582736fed1d137de45315788cd867f97341050d85ac083 · sha256:12ea10a1951b0625… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer