MediumVulnerability
GHSA-mxjx-28vx-xjjj: Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
- Identifier
- GHSA-mxjx-28vx-xjjj
- Published
- Record updated
- Affected
- network-ai >= 5.0.0, <= 5.12.1
- Fixed in
- 5.12.2
- released June 18, 2026, 1 day before disclosure
Summary
The ApprovalInbox HTTP server in network-ai (lib/approval-inbox.ts) has no authentication on any route and sets Access-Control-Allow-Origin: * on every route, including the state-changing POST /approvals/:id/approve and /deny. Any party able to reach the inbox port, including websites visited by the operator through wildcard CORS, can list pending approvals and approve them, which resolves the gate so the held high-risk action proceeds without consent. Affected versions are network-ai <= 5.11.0, and the flaw is mapped to CWE-862 and CWE-352.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online