Executive brief
Network-AI, a tool used to coordinate multiple AI agents, contains a security flaw in its human-approval system. This system is designed to stop AI agents from performing high-risk actions, like running shell commands, until a person manually approves them. Due to a lack of authentication and insecure web settings, an attacker—or even a malicious website visited by the operator—could bypass this safeguard and force the AI to execute dangerous commands without the user's consent.
Technical details
The `ApprovalInbox` component in `lib/approval-inbox.ts` exposes an HTTP server that lacks any authentication mechanism for its REST API. Furthermore, the server implements a wildcard `Access-Control-Allow-Origin: *` policy, making it susceptible to Cross-Site Request Forgery (CSRF) via a user's browser. An attacker can enumerate pending approvals via `GET /approvals/` and trigger state-changing actions via `POST /approvals/:id/approve`. This effectively bypasses the 'human-in-the-loop' security gate, allowing for the unauthorized execution of gated actions such as shell commands or financial transactions. The vulnerability is addressed in version 5.12.2 by introducing a mandatory `secret` option for network-exposed instances and implementing constant-time token validation.
Affected products
- Jovancoding Network-AI >= 5.0.0, <= 5.12.1
Timeline
- 2026-06-18: patched: Fixed in version 5.12.2
- 2026-07-20: disclosed: CVE-2026-58482 published