GHSA-qvf5-9prv-7r9c: Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations

Published Nov 2, 2026

Updated

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.

Event History

Nov 2, 2026

CVE Published

via OSV·02:01 AM

Data Sourced

via OSV·02:01 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated task access?

Network-AI versions 5.14.0 through versions before 5.15.5 are affected when the A2AServer has no secret configured. In that configuration, remote unauthenticated attackers can access task operations without a Bearer token.

What can an unauthenticated attacker do?

An attacker can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel. This allows them to execute tasks, read task results, and cancel tasks.

Does exploitation require credentials or user interaction?

No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges, and no user interaction; the affected condition is that no A2AServer secret is configured.

GHSA-qvf5-9prv-7r9c: Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated task access?

What can an unauthenticated attacker do?

Does exploitation require credentials or user interaction?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated task access?

What can an unauthenticated attacker do?

Does exploitation require credentials or user interaction?