CVE-2026-58414: Network-AI Information Disclosure Flaw

CVE-2026-58414 Overview

CVE-2026-58414 affects Network-AI, a TypeScript/Node.js multi-agent orchestrator. The vulnerability exists in the EnvironmentManager.backup() function prior to version 5.12.2. The _collectBackupFiles() helper uses statSync(), which transparently follows symbolic links during recursive file collection. A local attacker who can place a symlink under an environment data directory can cause the backup routine to traverse the link and copy files from outside the environment root into backup artifacts. This results in unauthorized disclosure of files stored under data/<env>/.backups/<backupId>/. The issue is classified under [CWE-22] Path Traversal and is fixed in version 5.12.2.

Critical Impact
A low-privileged local user can exfiltrate files outside the environment root by planting a symlink that the backup process silently follows.

Affected Products

Network-AI multi-agent orchestrator versions prior to 5.12.2
Deployments exposing the data/<env> directory to untrusted local writers
Environments relying on EnvironmentManager.backup() for backup artifact generation

Discovery Timeline

2026-07-20 - CVE-2026-58414 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-58414

Vulnerability Analysis

The vulnerability stems from unsafe file system traversal during backup collection. Network-AI's EnvironmentManager.backup() recursively enumerates files inside an environment's data directory using the _collectBackupFiles() helper. That helper calls Node.js statSync(full) on each entry to determine whether the path is a directory or a regular file. statSync() follows symbolic links by default, so directory symlinks appear as directories and file symlinks appear as regular files. The recursion then descends into linked directories and reads through linked files.

An attacker with local write access to any subpath under data/<env> can plant a symlink pointing to a sensitive location, such as configuration directories, private keys, or arbitrary paths on the host. When the next backup runs, the routine copies the linked content into data/<env>/.backups/<backupId>/, exposing files that reside outside the intended environment root.

Root Cause

The root cause is the use of statSync() instead of lstatSync() inside _collectBackupFiles(). Because statSync() resolves symbolic links, the backup logic never distinguishes real filesystem children from links pointing outside the environment boundary. There is no allow-list, path canonicalization, or containment check to enforce that resolved paths remain under data/<env>.

Attack Vector

Exploitation requires local access with permission to write into the environment data directory. The attacker creates a symlink such as data/<env>/leak -> /etc or a link to another tenant's directory. When a scheduled or user-triggered backup runs, EnvironmentManager.backup() traverses the symlink and writes the target contents into the backup artifact. The attacker then retrieves the artifact through normal backup access channels. The scope is limited to confidentiality; no code execution or integrity loss occurs as a direct result of the flaw.

The vulnerability manifests in the backup file collection routine. See the GitHub Security Advisory GHSA-6x2m-p4xp-wg22 and the GitHub Commit Change for exact source-level details.

Detection Methods for CVE-2026-58414

Indicators of Compromise

Symbolic links present anywhere under data/<env>/ that resolve to paths outside the environment root
Unexpectedly large backup artifacts under data/<env>/.backups/<backupId>/ containing files not owned by the environment
Backup contents that include host paths such as /etc, /root, or other tenants' directories
Filesystem audit events showing symlink creation by low-privileged users in environment data paths

Detection Strategies

Scan environment data directories for symbolic links using find data -type l and alert on any results
Inventory backup archive contents and flag entries whose original inode or absolute path lies outside data/<env>
Enable filesystem auditing (auditd on Linux) for symlink() and symlinkat() syscalls targeting the environment root
Compare pre-backup and post-backup file listings to detect unexpected file additions in backup artifacts

Monitoring Recommendations

Log every invocation of EnvironmentManager.backup() with the resolved paths of files copied into the artifact
Monitor for privilege boundary crossings between environments sharing a common backup process
Alert on backup artifacts that exceed a size baseline for a given environment

How to Mitigate CVE-2026-58414

Immediate Actions Required

Upgrade Network-AI to version 5.12.2 or later, which replaces statSync with lstatSync and skips symbolic links
Audit all data/<env> directories for existing symlinks and remove any that resolve outside the environment root
Review historical backup artifacts under .backups/ for leaked content and rotate any exposed secrets
Restrict write permissions on environment data directories to trusted process identities only

Patch Information

The fix is available in Network-AI v5.12.2. _collectBackupFiles() now calls lstatSync and skips any entry where isSymbolicLink() returns true, preventing traversal into linked paths. Details are published in the GitHub Release v5.12.2 and the corresponding GitHub Commit Change.

Workarounds

Run find data -type l -delete before every backup to strip symbolic links from environment directories
Execute backups under a mount namespace or chroot that hides paths outside the environment root
Set the environment data directory to noexec and enforce strict per-user ownership to limit who can create symlinks
Disable automated backups until patching is complete if the environment accepts input from untrusted local users

bash

# Configuration example
# Remove any pre-existing symlinks under environment data before upgrading
find /var/lib/network-ai/data -type l -print -delete

# Upgrade to the patched release
npm install network-ai@5.12.2