{"answers":{"affected":"2 open source packages ship an affected version, including network-ai. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-46701 in the wild and no public exploit code.","fix":"Upgrade network-ai to 5.4.5 or later.","what":"CVE-2026-46701 is a high-severity authentication bypass vulnerability in Jovancoding Network-AI, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-46701 and fix it if it is affected.\n\nWhat it is: CVE-2026-46701 is a high-severity authentication bypass vulnerability in Jovancoding Network-AI, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-46701 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- network-ai (npm): affected all versions; fixed in 5.4.5\n- network-ai (npm): affected all versions; fixed in 5.4.5\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-46701/ (Markdown: https://insights.sbomify.com/CVE-2026-46701/index.md)","id":"CVE-2026-46701","markdown":"https://insights.sbomify.com/CVE-2026-46701/index.md","name":"CVE-2026-46701","record":{"aliases":["GHSA-j3vx-cx2r-pvg8"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Node.js AI orchestrator","requires_auth":"none","summary":"Unauthenticated attackers can invoke MCP tools on default-configured Network-AI servers due to an empty secret and permissive CORS, enabling remote code execution and data modification.","user_interaction":"required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"network-ai","vendor":"network-ai"}],"cvss":{"score":7.6,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","version":"3.1"},"cwes":[{"id":"CWE-346","name":"Origin Validation Error"}],"description":"Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''` at `bin/mcp-server.ts:89`), which causes `_isAuthorized` (`lib/mcp-transport-sse.ts:254`) to return `true` unconditionally for every request — no `Authorization` header is required. Simultaneously, `_handleRequest` sets `Access-Control-Allow-Origin: *` (`lib/mcp-transport-sse.ts:272`) on every response, so a cross-origin browser fetch can read the result without restriction. An unauthenticated attacker who can lure a user to a malicious web page can invoke all 22 exposed MCP tools — including `config_set`, `agent_spawn`, and `blackboard_write` — against a default-configured localhost server. Version 5.4.5 patches the issue.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret","id":"CVE-2026-46701","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":2,"n_references":3,"next":{"headline":"Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets","id":"CVE-2026-46702"},"packages":[{"ecosystem":"npm","fixed":["5.4.5"],"introduced":["0"],"last_affected":[],"package":"network-ai","purl":null,"source":"GHSA-j3vx-cx2r-pvg8"},{"ecosystem":"npm","fixed":["5.4.5"],"introduced":["0"],"last_affected":[],"package":"network-ai","purl":"pkg:npm/network-ai","source":"GHSA-j3vx-cx2r-pvg8"}],"prev":{"headline":"@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets","id":"CVE-2026-46700"},"products":["Network-AI"],"published":"2026-07-20","related":[{"cvss_score":7.1,"headline":"Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning","id":"CVE-2026-58484","kev_date_added":null,"published":"2026-07-20"},{"cvss_score":6.5,"headline":"Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory","id":"CVE-2026-58481","kev_date_added":null,"published":"2026-07-20"},{"cvss_score":6.1,"headline":"EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data","id":"CVE-2026-58413","kev_date_added":null,"published":"2026-07-20"},{"cvss_score":5.9,"headline":"Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions","id":"CVE-2026-58482","kev_date_added":null,"published":"2026-07-20"},{"cvss_score":5.5,"headline":"Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups","id":"CVE-2026-58414","kev_date_added":null,"published":"2026-07-20"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-20","vendors":["Jovancoding"]},"summary":"Unauthenticated attackers can invoke MCP tools on default-configured Network-AI servers due to an empty secret and permissive CORS, enabling remote code execution and data modification.","url":"https://insights.sbomify.com/CVE-2026-46701/"}