HighVulnerability
GHSA-fj4g-2p96-q6m3: Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls
- Identifiers
- CVE-2026-42856GHSA-fj4g-2p96-q6m3
- Published
- Record updated
- Affected
- network-ai <= 5.1.2
- Fixed in
- 5.1.3
- released April 23, 2026, 12 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
Network-AI version 5.1.2 (commit c344f2053eb0d49395988f803bf92f2a86b2a0d0) accepts JSON-RPC tools/call requests on its MCP HTTP transport with no authentication, session, origin or token check, dispatching them straight to the orchestrator's tool registry. The default bind address is 0.0.0.0, so any party with network reachability can list and invoke privileged tools such as config_get and config_set, agent_spawn, token_create and budget_set_ceiling. The advisory is rated High (CWE-306) and was validated on 2026-04-21 with a proof of concept that changed a live configuration value without credentials.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
- MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
- MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
- MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
- CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database