CVE-2026-120314

Name of the Vulnerable Software and Affected Versions Network-AI versions 5.14.0 through 5.15.4

Description A missing authentication issue exists in the A2AServer class. When no secret is configured, the system skips Bearer authentication, allowing unauthenticated attackers to access task operations. Attackers can send JSON-RPC requests to the following endpoints: 'tasks/send', 'tasks/get', and 'tasks/cancel' to execute tasks, read results, and cancel tasks. The impact depends on the capabilities of the application-defined executor.

Recommendations Upgrade Network-AI to version 5.15.5 or later. Configure a nonempty secret for the A2AServer to ensure unauthorized requests are rejected. Restrict untrusted access to the A2A listeners.