Is CVE-2026-120314 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120314 being exploited in the wild.

How severe is CVE-2026-120314?

High severity, with a CVSS score of 7.3, published 2 November 2026.

Which products and versions are affected?

Jovancoding Network-AI 5.14.0 to 5.15.4.

How is CVE-2026-120314 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120314?

Check whether you run Jovancoding Network-AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120314: Network-AI A2AServer missing authentication in task operations

CVE-2026-120314 · Severity: high · CVSS 7.3 · Published 2026-11-02

Network-AI's A2AServer is a network service that allows agents to submit, retrieve, and cancel computational tasks. When deployed without a secret configured (the default), the service accepts all task requests from any network client without authentication, allowing attackers to execute arbitrary tasks, read results, and disrupt operations.

Technologies: Jovancoding Network-AI. Vendors: Jovancoding.

Quick answers

Is CVE-2026-120314 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120314 being exploited in the wild.
How severe is CVE-2026-120314?: High severity, with a CVSS score of 7.3, published 2 November 2026.
Which products and versions are affected?: Jovancoding Network-AI 5.14.0 to 5.15.4.
Is there a fix for CVE-2026-120314?: Yes: fixed in 5.15.5. Until then: Configure a strong secret value in the A2AServer options when starting the server, or restrict network access to the A2AServer endpoint using firewall rules or network segmentation to limit exposure to trusted clients only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120314 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120314?: Check whether you run Jovancoding Network-AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.15.5

Configure a strong secret value in the A2AServer options when starting the server, or restrict network access to the A2AServer endpoint using firewall rules or network segmentation to limit exposure to trusted clients only.

Technical details

The A2AServer class implements Bearer token authentication guarded by a conditional check on the optional secret configuration option; when no secret is provided, the authentication block is skipped entirely and the server accepts unauthenticated JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel endpoints. An attacker with network access can submit arbitrary task payloads to the configured executor without credentials. A fix is available in version 5.15.5.

Affected products

Jovancoding Network-AI 5.14.0 to 5.15.4

Timeline

2026-10-17: disclosed
2026-11-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.