CVE-2026-109332

Name of the Vulnerable Software and Affected Versions network-ai versions prior to 5.15.2

Description An origin validation error exists in the McpSseServer. handleRequest function within lib/mcp-transport-sse.ts. This issue allows localhost origins to be reflected into the Access-Control-Allow-Origin header, regardless of the bind interface. If the server binds to a non-loopback address, a malicious page with a localhost origin visited by a victim can perform cross-origin reads of unauthenticated endpoints, such as the '/health' endpoint.

Recommendations Update network-ai to version 5.15.2 or later.