CVE-2026-109330 Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer
Remote attackers can hijack WebSocket connections to exfiltrate sensitive agent topology data from the Network-AI dashboard.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-109330?
CVE-2026-109330 is a medium-severity vulnerability in Jovancoding Network-AI, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.
Weakness: CWE-1385
Which versions are affected by CVE-2026-109330?
How do I fix CVE-2026-109330?
No fix has been published for CVE-2026-109330 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-109330 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109330 exists.
Sources
Also known as GHSA-hr6v-mfxm-4438, GHSA-q84g-m42h-q9rc.