CVE-2026-73614: Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation
Published Aug 13, 2026
·Updated
Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.
Affected Software
1 affected component
Network-AI ClaudeHookBridge<5.15.1
Event History
Aug 13, 2026
CVE Published
via MITRE·11:28 AM
Data Sourced
via MITRE·11:28 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-73614?
CVE-2026-73614 has a high severity score of 8.8.
2
How do I fix CVE-2026-73614?
To fix CVE-2026-73614, ensure that you update Network-AI ClaudeHookBridge to version 5.15.1 or later.
3
What is the impact of CVE-2026-73614?
CVE-2026-73614 can allow attackers to bypass deny patterns by exploiting command truncation.
4
Who is affected by CVE-2026-73614?
Users of Network-AI ClaudeHookBridge versions prior to 5.15.1 are affected by CVE-2026-73614.
5
What vector does CVE-2026-73614 exploit?
CVE-2026-73614 exploits the truncation of target strings in the denyPatterns evaluation.