CVE-2026-46701 Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
Unauthenticated attackers can invoke MCP tools on default-configured Network-AI servers due to an empty secret and permissive CORS, enabling remote code execution and data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-46701?
CVE-2026-46701 is a high-severity authentication bypass vulnerability in Jovancoding Network-AI, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''` at `bin/mcp-server.ts:89`), which causes `_isAuthorized` (`lib/mcp-transport-sse.ts:254`) to return `true` unconditionally for every request — no `Authorization` header is required. Simultaneously, `_handleRequest` sets `Access-Control-Allow-Origin: *` (`lib/mcp-transport-sse.ts:272`) on every response, so a cross-origin browser fetch can read the result without restriction. An unauthenticated attacker who can lure a user to a malicious web page can invoke all 22 exposed MCP tools — including `config_set`, `agent_spawn`, and `blackboard_write` — against a default-configured localhost server. Version 5.4.5 patches the issue.
Weakness: CWE-346
Which versions are affected by CVE-2026-46701?
2 open source packages ship an affected version, including network-ai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
network-ai npm | All versions | 5.4.5 |
network-ai npm | All versions | 5.4.5 |
Products include Network-Ai Network-Ai.
How do I fix CVE-2026-46701?
Upgrade network-ai to 5.4.5 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-46701 being exploited?
There is no known exploitation of CVE-2026-46701 in the wild and no public exploit code.
Other vulnerabilities in Jovancoding Network-AI
- CVE-2026-58484 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
- CVE-2026-58481 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
- CVE-2026-58413 EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
- CVE-2026-58482 Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
- CVE-2026-58414 Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
Sources
Also known as GHSA-j3vx-cx2r-pvg8.