CVE-2026-48814
published 2026-06-17CVE-2026-48814: Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP SSE server allows unauthenticated cross-origin MCP tool…
PriorityP262critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.30%
21.3th percentile
Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP SSE server allows unauthenticated cross-origin MCP tool invocation due to an empty default secret. This issue was partially addressed by CVE-2026-46701 in version 5.4.5 by closing the CORS flaw (with Access-Control-Allow-Origin now set only for localhost origins), but the empty-default-secret flaw described in the title remained: the SSE MCP server still defaulted to an empty secret, _isAuthorized() still returned true when the secret was empty, and a non-loopback bind only produced a warning. As a result, the server still ran fully unauthenticated by default. Any non-browser caller (for example, curl, SSRF, or a 0.0.0.0 bind) could invoke all 22 MCP tools (config_set, agent_spawn, blackboard_write, token_*) with no credentials. This issue was fixed in version 5.7.2.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jovancoding | network-ai | < 5.7.2 | 5.7.2 |
| jovancoding | network-ai | >= 0 < 5.7.2 | 5.7.2 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
cvelistv5v3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Jovancoding Network-AI up to 5.7.1 _isAuthorized missing authentication (GHSA-r78r-rwrf-rjwp / EUVD-2026-37787)
vuldb·2026-06-19
CVE-2026-48814 [CRITICAL] Jovancoding Network-AI up to 5.7.1 _isAuthorized missing authentication (GHSA-r78r-rwrf-rjwp / EUVD-2026-37787)
A vulnerability classified as critical was found in Jovancoding Network-AI up to 5.7.1. This issue affects the function _isAuthorized. Such manipulation leads to missing authentication.
This vulnerability is traded as CVE-2026-48814. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is advised.
GHSA
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
ghsa·2026-06-19
CVE-2026-48814 [CRITICAL] CWE-306 Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
## Advisory / Disclosure
# Network-AI — CVE-2026-46701 fix is incomplete: the "Empty Default Secret" unauth path survives
**Target:** Jovancoding/Network-AI (npm `network-ai`), **latest v5.7.1**
**Status:** the advisory ("Unauthenticated Cross-Origin MCP Tool Invocation via Empty
Default Secret") named three flaws. The fix (5.4.5) closed the **CORS** flaw
(`Access-Control-Allow-Origin` is now set only for localhost origins), but left the
**empty-default-secret** flaw the title is about: the SSE MCP server still defaults to an
empty secret, `_isAuthorized()` still returns `true` when the secret is empty, and a
non-loopback bind only **warns**. So the server still runs **fully unauthenticated by
CVEList
Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)
cvelistv5·2026-06-17·CVSS 9.1
CVE-2026-48814 [CRITICAL] CWE-306 Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)
Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)
Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP SSE server allows unauthenticated cross-origin MCP tool invocation due to an empty default secret. This issue was partially addressed by CVE-2026-46701 in version 5.4.5 by closing the CORS flaw (with Access-Control-Allow-Origin now set only for localhost origins), but the empty-default-secret flaw described in the title remained: the SSE MCP server still defaulted to an empty secret, _isAuthorized() still returned true when the secret was empty, and a non-loopback bind only produced a warning. As a result, the server still ran fully unauthenticated by default. Any non-browser caller (for examp
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-17
Published