CVE-2026-48814: Network-AI Auth Bypass Vulnerability

CVE-2026-48814 Overview

CVE-2026-48814 is a missing authentication vulnerability [CWE-306] in Network-AI, a TypeScript/Node.js multi-agent orchestrator. The Model Context Protocol (MCP) Server-Sent Events (SSE) server in versions 5.7.1 and earlier defaults to an empty secret. The _isAuthorized() function returns true when the secret is empty, leaving the server fully unauthenticated by default. Any non-browser caller, including curl, Server-Side Request Forgery (SSRF) chains, or a 0.0.0.0 bind, can invoke all 22 MCP tools without credentials. Affected tools include config_set, agent_spawn, blackboard_write, and the token_* family. The maintainer fixed the issue in version 5.7.2.

Critical Impact
Unauthenticated remote attackers can invoke privileged MCP tools to spawn agents, modify configuration, and manipulate orchestrator state.

Affected Products

Network-AI versions 5.7.1 and earlier
Network-AI MCP SSE server component
Deployments binding the SSE server to non-loopback interfaces

Discovery Timeline

2026-06-17 - CVE-2026-48814 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48814

Vulnerability Analysis

The Network-AI MCP SSE server exposes 22 tools that control orchestrator behavior. These tools include config_set for configuration changes, agent_spawn for launching agents, blackboard_write for shared state manipulation, and the token_* family for credential operations. Access to these tools requires authorization through the _isAuthorized() check.

The related CVE-2026-46701 fix in version 5.4.5 addressed a Cross-Origin Resource Sharing (CORS) flaw by restricting Access-Control-Allow-Origin to localhost origins. That fix blocked browser-based cross-origin invocation but did not enforce authentication on direct requests. Non-browser clients still reach the SSE endpoint without CORS enforcement.

Root Cause

The SSE MCP server ships with an empty default secret. The _isAuthorized() function returns true whenever the configured secret is empty, treating the unset state as an authorized state. The server also binds to non-loopback interfaces with only a console warning, allowing exposure to remote networks without operator confirmation.

Attack Vector

An attacker reaches the SSE endpoint over the network and issues MCP tool invocations directly. No credentials, tokens, or headers are required. Exploitation paths include direct requests from curl against an exposed 0.0.0.0 bind, SSRF chains from co-located web services, and lateral movement from compromised hosts on the same network segment. Successful invocation of config_set permits persistent configuration tampering, while agent_spawn enables arbitrary agent execution within the orchestrator context.

The vulnerability is described in prose only because no public proof-of-concept code has been verified. See the GitHub Security Advisory GHSA-r78r-rwrf-rjwp for maintainer-provided technical details.

Detection Methods for CVE-2026-48814

Indicators of Compromise

Unexpected invocations of config_set, agent_spawn, blackboard_write, or token_* tools in MCP server logs
HTTP requests to the SSE endpoint from non-loopback source addresses without authentication headers
Network-AI process bound to 0.0.0.0 or a public interface with an empty secret configuration value
Newly spawned agent processes that do not correspond to operator-initiated workflows

Detection Strategies

Audit Network-AI configuration files for empty or missing secret values in MCP SSE server settings
Inspect listening sockets on hosts running Network-AI for binds outside 127.0.0.1 or ::1
Review reverse proxy and gateway logs for requests reaching the MCP SSE path from external networks
Correlate agent_spawn and config_set events with authenticated operator sessions to identify orphaned invocations

Monitoring Recommendations

Forward Network-AI application logs to a centralized log platform and alert on tool invocations lacking session context
Monitor outbound connections from spawned agents for unexpected destinations
Track changes to orchestrator configuration through file integrity monitoring on Network-AI configuration paths

How to Mitigate CVE-2026-48814

Immediate Actions Required

Upgrade Network-AI to version 5.7.2 or later, which enforces authentication when the secret is empty
Bind the MCP SSE server to 127.0.0.1 until the upgrade is applied
Configure a strong, non-empty secret for the MCP SSE server and rotate any tokens that may have been exposed
Block external network access to the MCP SSE port at the host firewall and perimeter

Patch Information

The maintainer released the fix in Network-AI v5.7.2. Additional details are available in the GitHub Advisory GHSA-j3vx-cx2r-pvg8 and the GitHub Security Advisory GHSA-r78r-rwrf-rjwp.

Workarounds

Set a strong secret in the MCP SSE server configuration before starting the service
Restrict the listening interface to 127.0.0.1 and route trusted access through an authenticated reverse proxy
Apply host-based firewall rules to deny inbound traffic to the SSE port from non-loopback sources

bash

# Configuration example
# Restrict the MCP SSE server to localhost and require a secret
export MCP_SSE_BIND="127.0.0.1"
export MCP_SSE_SECRET="$(openssl rand -hex 32)"

# Host firewall rule to block external access to the SSE port
sudo iptables -A INPUT -p tcp --dport 3000 ! -s 127.0.0.1 -j DROP