CVE-2026-58482
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Vulnerability in Network-AI (versions 5.0.0-5.12.1) in the ApprovalInbox component. The HTTP server lacks authentication and sets Access-Control-Allow-Origin: *, allowing anyone who can send an HTTP request (including websites in the operator's browser) to approve pending high-risk actions without human consent.
Risk Assessment
The organization risks execution of dangerous operations (e.g., shell commands) without human oversight, potentially leading to unauthorized system changes.
Recommendation
Update Network-AI to version 5.12.2 and configure a secret key for ApprovalInbox. Ensure the server listens only on 127.0.0.1.
Other vulnerabilities in Network-AI
See all- CVE-2026-73614High
Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.
- CVE-2026-54051Critical
Vulnerability in Network-AI (TypeScript/Node.js) before version 5.9.1 allows bypassing the shell command allowlist. An attacker can execute arbitrary commands by injecting special characters (e.g., `;`).
- CVE-2026-73615High
Network-AI before version 5.15.1 contains a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.
- CVE-2026-58484High
In Network-AI (TypeScript/Node.js multi-agent orchestrator) before version 5.12.2, a vulnerability was found where the 'path' field in backup manifest files is trusted. An attacker can place a malicious manifest, causing arbitrary file or directory deletion during backup pruning.
- CVE-2026-58481Medium
Vulnerability in Network-AI (versions before 5.12.2) in the file sandbox mechanism. Path checks rely on string prefix matching, allowing an agent to read files from sibling directories with similar names (e.g., /tmp/network-ai-sandbox_evil) outside the intended sandbox.
- CVE-2026-58414Medium
Vulnerability in Network-AI (versions before 5.12.2) in the environment backup function. The _collectBackupFiles() function follows symbolic links, allowing an attacker to place a symlink to an external directory and copy its contents into the backup archive.
- CVE-2026-58413Medium
Vulnerability in Network-AI (versions before 5.12.2) in the environment restore function. The restore() function does not verify that the backup path is within the allowed directory, allowing a backup ID with ../ sequences to restore files from arbitrary directories.
- CVE-2026-46701High
Network-AI before version 5.4.5 defaults to an empty MCP SSE secret, allowing any unauthenticated request to be accepted. Additionally, the CORS header permits access from any origin, enabling an attacker to remotely invoke all 22 MCP tools on a local server.
- CVE-2026-64623High
Network-AI before version 5.13.4 has an improper cryptographic signature verification vulnerability in APSAdapter. The default local verifier accepts any non-empty string as valid. An unauthenticated attacker can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain permission tokens for sensitive resources including SHELL_EXEC.
- CVE-2026-64622High
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply configured authorization to GET /approvals/ routes, allowing unauthenticated actors to access sensitive approval data including shell commands, file paths, and risk levels. Additionally, the Access-Control-Allow-Origin: * header enables cross-origin disclosure.
Original NVD description (English source)
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret.