CVE-2026-46701: Network-AI Auth Bypass Vulnerability

CVE-2026-46701 Overview

Network-AI is a TypeScript/Node.js multi-agent orchestrator that exposes a Model Context Protocol (MCP) Server-Sent Events (SSE) endpoint. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret, causing the _isAuthorized check to return true for every request. The server also emits Access-Control-Allow-Origin: * on every response, allowing cross-origin browser fetches to read results without restriction. An unauthenticated attacker who lures a user to a malicious web page can invoke all 22 exposed MCP tools against a default-configured localhost server. This vulnerability is tracked as [CWE-346: Origin Validation Error].

Critical Impact
Attackers can invoke sensitive MCP tools including config_set, agent_spawn, and blackboard_write on a victim's localhost Network-AI server through drive-by browser requests.

Affected Products

Network-AI multi-agent orchestrator (npm package by Jovancoding)
All versions prior to 5.4.5 running in MCP SSE/HTTP mode
Default localhost deployments without NETWORK_AI_MCP_SECRET configured

Discovery Timeline

2026-07-20 - CVE-2026-46701 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-46701

Vulnerability Analysis

The Network-AI MCP SSE server implements an authorization check in lib/mcp-transport-sse.ts that compares an incoming bearer token against a configured secret. When operators start the server without setting NETWORK_AI_MCP_SECRET or passing --secret, the configuration defaults to an empty string. The _isAuthorized function then returns true unconditionally for every request, whether or not an Authorization header is present.

Compounding the authentication bypass, _handleRequest at lib/mcp-transport-sse.ts:272 sets Access-Control-Allow-Origin: * on every response. This permissive CORS policy allows any origin to read responses from the server. A victim browsing an attacker-controlled page triggers cross-origin fetch() calls against http://127.0.0.1:<port>, and the browser accepts the responses.

Root Cause

The root cause is an insecure default configuration. The line process.env['NETWORK_AI_MCP_SECRET'] ?? '' at bin/mcp-server.ts:89 substitutes an empty string when the environment variable is unset. The authorization comparison then treats the empty secret as valid, granting full tool access. Combined with wildcard CORS, this exposes 22 MCP tools including config_set, agent_spawn, and blackboard_write to any web origin.

Attack Vector

Exploitation requires a victim running Network-AI locally in SSE mode to visit an attacker-controlled web page. JavaScript on that page issues cross-origin requests to the local MCP endpoint. Because no authentication is enforced and CORS is wildcard, the browser delivers responses back to the attacker's script, enabling remote agent spawning, configuration tampering, and blackboard writes.

typescript

// Patch in bin/mcp-server.ts — require --secret in SSE mode
  // SSE/HTTP mode
-  const isLoopback = args.host === '127.0.0.1' || args.host === 'localhost' || args.host === '::1';
-  if (!isLoopback && !args.secret) {
-    console.warn(
-      '\n[network-ai-server] WARNING: Binding to ' + args.host +
-      ' with no --secret set. Any network-reachable client can access all' +
-      ' 22 MCP tools, including config_set and agent_spawn. Pass' +
-      ' --secret <token> or set NETWORK_AI_MCP_SECRET to require authentication.\n'
+  if (!args.secret) {
+    process.stderr.write(
+      '[network-ai-server] ERROR: --secret <token> or NETWORK_AI_MCP_SECRET must be set for SSE mode.\n' +
+      '  Without a secret every request is accepted, including cross-origin browser requests\n' +
+      '  that can invoke all MCP tools (config_set, agent_spawn, blackboard_write, …) without credentials.\n' +
+      '  Set a secret: --secret <token>  or  export NETWORK_AI_MCP_SECRET=<token>\n' +
+      '  For local stdio use (Claude Desktop / Cursor / Glama) run with --stdio instead.\n'
     );
+    process.exit(1);
   }

Source: GitHub Commit dc50481

Detection Methods for CVE-2026-46701

Indicators of Compromise

Unexpected calls to MCP tool endpoints (config_set, agent_spawn, blackboard_write) in Network-AI server logs
HTTP requests to http://127.0.0.1:<mcp-port> originating from browser Origin or Referer headers pointing to unknown external sites
New or modified agent configurations that were not initiated by the local operator

Detection Strategies

Inspect Network-AI MCP SSE server logs for requests lacking an Authorization header that still succeed
Deploy endpoint process telemetry to identify Node.js processes running mcp-server bound to loopback without NETWORK_AI_MCP_SECRET in their environment
Correlate outbound browser traffic to attacker-controlled domains with concurrent inbound localhost MCP requests

Monitoring Recommendations

Alert when Network-AI versions below 5.4.5 are detected on developer or workstation endpoints
Monitor for the process command line pattern mcp-server without --secret or --stdio flags
Track HTTP responses from local MCP ports carrying Access-Control-Allow-Origin: * in packet captures or proxy logs

How to Mitigate CVE-2026-46701

Immediate Actions Required

Upgrade Network-AI to version 5.4.5 or later, which forces --secret or NETWORK_AI_MCP_SECRET and exits when neither is set in SSE mode
For local integrations with Claude Desktop, Cursor, or Glama, switch to --stdio mode instead of SSE
Audit running instances and terminate any Network-AI MCP SSE server started without a secret

Patch Information

The fix is delivered in Network-AI v5.4.5. The commit dc50481 makes the secret mandatory in SSE mode and hardens CORS handling. Full technical details are documented in GHSA-j3vx-cx2r-pvg8.

Workarounds

Set a strong random secret via export NETWORK_AI_MCP_SECRET=<token> before launching the SSE server
Prefer --stdio transport for local editor and desktop MCP client integrations to avoid HTTP exposure
Restrict outbound browser access on developer workstations or use browser extensions that block cross-origin requests to loopback addresses

bash

# Configuration example — start Network-AI MCP server with mandatory secret
export NETWORK_AI_MCP_SECRET="$(openssl rand -hex 32)"
npx network-ai mcp-server --host 127.0.0.1 --secret "$NETWORK_AI_MCP_SECRET"

# Or use stdio transport for local IDE/desktop MCP clients
npx network-ai mcp-server --stdio