CVE-2026-64622: Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm: network-aito a version that resolves this vulnerability.Fixed in 5.13.3 - Compensating control
Until upgraded, block unauthenticated access to the Network-AI ApprovalInbox endpoints (GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, GET /approvals/sse) at the network layer (e.g., firewall/ACL/WAF) and restrict access to trusted clients only.
- Compensating control
Remove/override any CORS configuration that sets Access-Control-Allow-Origin: * for the affected Network-AI API responses to prevent cross-origin disclosure from arbitrary websites.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64622?
CVE-2026-64622 has a severity rating of high, with a score of 7.5.
How do I fix CVE-2026-64622?
To fix CVE-2026-64622, upgrade Network-AI to versions 5.13.4 or later where the missing authorization issue has been addressed.
What are the risks associated with CVE-2026-64622?
The risks associated with CVE-2026-64622 include unauthorized access to sensitive approval request details by unauthenticated actors.
Which versions are affected by CVE-2026-64622?
CVE-2026-64622 affects Network-AI versions 5.12.2 through 5.13.3.
Does CVE-2026-64622 affect data confidentiality?
Yes, CVE-2026-64622 compromises data confidentiality by allowing unauthorized access to sensitive information.