CVE-2026-64622: Network-AI npm Information Disclosure Flaw

CVE-2026-64622 Overview

CVE-2026-64622 is a missing authorization vulnerability in the Network-AI npm package (network-ai), affecting versions 5.12.2 through 5.13.3. The flaw resides in the ApprovalInbox GET read routes, which fail to enforce the configured checkAuth/secret authorization check. Unauthenticated remote actors can read sensitive approval request data including shell command strings, target file paths, justifications, and risk levels. All affected responses also include a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website an operator visits. This issue is an incomplete fix for GHSA-mxjx-28vx-xjjj.

Critical Impact
Unauthenticated attackers can read full ApprovalEntry content, including pending shell commands and file operation targets, from any Network-AI deployment in the affected version range.

Affected Products

Network-AI npm package (network-ai) version 5.12.2
Network-AI npm package (network-ai) versions 5.13.0 through 5.13.3
Deployments exposing the ApprovalInbox HTTP interface

Discovery Timeline

2026-07-20 - CVE-2026-64622 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64622

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw [CWE-862] in the ApprovalInbox HTTP handler. Network-AI supports a checkAuth/secret mechanism intended to gate access to approval data. Read routes were not wired into that check, so the authorization layer is bypassed on GET requests regardless of configuration.

The following endpoints disclose full ApprovalEntry content without authentication:

GET /approvals/?status=all
GET /approvals/:id
GET /approvals/stats
GET /approvals/sse

Disclosed fields include the pending action, the target shell-command string, file paths, human-written justifications, and computed risk levels. Because Network-AI acts as an approval gate for automated actions, this content reveals the exact commands operators are about to authorize.

All responses carry Access-Control-Allow-Origin: *, so any origin can issue authenticated-equivalent cross-origin reads via a browser. An operator merely visiting a malicious page is sufficient to leak the queue contents.

Root Cause

The GET read routes for ApprovalInbox were not registered behind the checkAuth middleware that enforces the configured secret. The prior fix in GHSA-mxjx-28vx-xjjj addressed related routes but omitted the read paths. A hardcoded permissive CORS header compounds the issue by removing browser-side origin isolation.

Attack Vector

The attack requires only network reachability to the Network-AI listener. An unauthenticated attacker sends a GET request to /approvals/?status=all or /approvals/:id and receives the full JSON payload. In the cross-origin variant, an attacker hosts JavaScript that issues fetch('http://target/approvals/?status=all') when a Network-AI operator visits the page, exfiltrating the response to an attacker-controlled server.

The vulnerability manifests in the Express-style route registration for ApprovalInbox. Refer to the GitHub Security Advisory and the VulnCheck Security Advisory for the maintainer-provided technical details.

Detection Methods for CVE-2026-64622

Indicators of Compromise

Unauthenticated HTTP GET requests to /approvals/, /approvals/:id, /approvals/stats, or /approvals/sse in web server or reverse-proxy logs.
Long-lived Server-Sent Events connections to /approvals/sse from IP addresses outside the expected operator range.
HTTP responses from Network-AI hosts containing Access-Control-Allow-Origin: * alongside approval JSON payloads.
Requests to approval endpoints carrying browser Origin or Referer headers not matching internal tooling.

Detection Strategies

Alert on any request to /approvals/* that lacks the configured secret header or cookie when checkAuth is enabled.
Correlate access logs against the operator IP allowlist and flag external sources.
Inspect outbound proxy traffic for browser-originated fetch calls to internal Network-AI hosts.

Monitoring Recommendations

Enable verbose request logging on the Network-AI process, capturing method, path, source IP, and Origin header.
Forward logs to a SIEM and build a rule for successful 200 responses on /approvals/* without an associated authenticated session.
Monitor the running network-ai package version across managed hosts and alert on any instance in the 5.12.2 to 5.13.3 range.

How to Mitigate CVE-2026-64622

Immediate Actions Required

Upgrade network-ai to a version outside the affected 5.12.2 through 5.13.3 range as soon as a fixed release is published by the maintainer.
Restrict network access to the ApprovalInbox listener to trusted operator hosts using firewall rules or a reverse proxy allowlist.
Rotate any secrets, commands, or file paths that may have been disclosed while the vulnerable version was reachable.

Patch Information

Consult the GitHub Security Advisory GHSA-m4jg-6w3q-gm86 for the fixed version and remediation guidance. Because this issue is an incomplete fix for GHSA-mxjx-28vx-xjjj, verify that the deployed version explicitly lists both advisories as resolved.

Workarounds

Place Network-AI behind a reverse proxy that enforces authentication on all /approvals/* routes before requests reach the Node.js process.
Strip or override the Access-Control-Allow-Origin header at the proxy so only trusted operator origins are permitted.
Bind the Network-AI listener to 127.0.0.1 and require operators to connect through an authenticated tunnel or VPN.
Disable the ApprovalInbox HTTP interface entirely if it is not required for current workflows.

bash

# Example nginx reverse-proxy snippet enforcing auth and safe CORS
location /approvals/ {
    if ($http_x_network_ai_secret != "REPLACE_WITH_SECRET") { return 401; }
    proxy_pass http://127.0.0.1:PORT;
    proxy_hide_header Access-Control-Allow-Origin;
    add_header Access-Control-Allow-Origin "https://operator.example.internal" always;
}