CVE-2026-46701

Name of the Vulnerable Software and Affected Versions Network-AI versions prior to 5.4.5

Description The MCP SSE server defaults to an empty secret via the NETWORK AI MCP SECRET environment variable, which causes the isAuthorized() function to return true for all requests regardless of whether an Authorization header is provided. Additionally, the handleRequest() function applies a wildcard Access-Control-Allow-Origin: * header to all responses, allowing cross-origin browser requests to read the results. An unauthenticated attacker can lure a user to a malicious webpage to invoke 22 exposed MCP tools against a default-configured localhost server, including config set, agent spawn, and blackboard write.

Recommendations Update to version 5.4.5. As a temporary mitigation, ensure the NETWORK AI MCP SECRET environment variable is set to a non-empty value. Restrict the use of the MCP SSE server to trusted origins by replacing the wildcard CORS header with a specific allowlist of localhost origins.