Executive brief
Network-AI is a tool used to manage and coordinate multiple AI agents. A security flaw in its server component allows unauthorized individuals to remotely control the software if it is running on a user's computer. By tricking a user into visiting a malicious website, an attacker can silently execute commands to change configurations, spawn new AI agents, or modify internal data without needing any passwords or credentials.
Technical details
The Network-AI MCP SSE server defaults to an empty secret for authentication, causing the `_isAuthorized` check to return true for all requests even when no Authorization header is present. Simultaneously, the server implements a wildcard 'Access-Control-Allow-Origin: *' header on all responses. This combination allows an unauthenticated attacker to perform a Cross-Origin Resource Sharing (CORS) exploit. If a user running the server locally visits a malicious webpage, that page can use browser-based fetch requests to invoke any of the 22 exposed MCP tools (such as `config_set` or `agent_spawn`) and read the results. The issue is fixed in version 5.4.5 by requiring a non-empty secret and restricting CORS origins to localhost.
Affected products
- Jovancoding Network-AI (npm package network-ai) < 5.4.5
Timeline
- 2026-05-16: patched: Version 5.4.5 released
- 2026-07-20: disclosed: CVE-2026-46701 published