CVE-2026-64623: Network-AI Auth Bypass Vulnerability

CVE-2026-64623 Overview

CVE-2026-64623 is an improper cryptographic signature verification vulnerability [CWE-347] in Network-AI versions before 5.13.4. The flaw resides in the APSAdapter component, where the default local verifier accepts any non-empty string as a valid signature. Unauthenticated attackers can submit forged Agent Permission System (APS) delegation payloads with arbitrary scopes. This bypass allows adversaries to obtain signed permission-grant tokens for sensitive resources, including SHELL_EXEC.

Critical Impact
Unauthenticated attackers can forge APS delegation payloads to obtain permission-grant tokens for SHELL_EXEC, enabling execution of arbitrary shell commands on affected Network-AI deployments.

Affected Products

Network-AI versions prior to 5.13.4
Deployments using the default local APSAdapter verifier
Systems exposing APS delegation endpoints to untrusted networks

Discovery Timeline

2026-07-20 - CVE-2026-64623 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64623

Vulnerability Analysis

The vulnerability lives in the APSAdapter module of Network-AI. The default local verifier applies a truthy check on the signature field rather than performing cryptographic verification. Any non-empty string is treated as a valid signature over the associated payload.

The APS (Agent Permission System) uses signed delegation tokens to authorize scoped access to sensitive capabilities. Because the verifier fails open, an attacker can craft a delegation payload requesting any scope, attach an arbitrary signature string, and pass verification. The system then issues a legitimately signed permission-grant token bound to the requested scope.

One of the requestable scopes is SHELL_EXEC, which authorizes shell command execution through downstream APS-integrated components. This converts a signature verification defect into unauthenticated command execution against the host.

Root Cause

The root cause is the local verifier's failure to invoke actual cryptographic primitives. Rather than validating the signature against a public key or shared secret, the code path returns success whenever the signature parameter is non-empty. This maps directly to [CWE-347: Improper Verification of Cryptographic Signature].

Attack Vector

Exploitation is remote and requires no authentication or user interaction. An attacker sends a crafted APS delegation request over the network. The request contains a JSON payload specifying elevated scopes such as SHELL_EXEC and any placeholder signature value. The APSAdapter accepts the forged delegation and returns a signed permission-grant token, which the attacker then presents to APS-enabled endpoints to invoke privileged operations. Technical details are documented in the GitHub Security Advisory GHSA-3jf7-33vc-hgf4 and the VulnCheck Security Advisory.

Detection Methods for CVE-2026-64623

Indicators of Compromise

APS delegation requests originating from unexpected source addresses or unauthenticated sessions
Permission-grant tokens issued for high-privilege scopes such as SHELL_EXEC without a corresponding authenticated user context
Anomalous child processes spawned by the Network-AI service account following APS token issuance
Delegation payloads containing malformed, static, or repeated signature values

Detection Strategies

Audit APSAdapter logs for delegation grants that reference sensitive scopes and correlate against authorized delegation policies
Deploy behavioral analytics on the Network-AI host to identify shell command execution triggered by the service process
Flag inbound API traffic to APS delegation endpoints from networks that should not have access

Monitoring Recommendations

Monitor process creation events where the Network-AI runtime is the parent process
Alert on outbound network connections initiated by Network-AI immediately following APS token requests
Track version metadata across Network-AI instances to identify hosts still running builds prior to 5.13.4

How to Mitigate CVE-2026-64623

Immediate Actions Required

Upgrade all Network-AI deployments to version 5.13.4 or later without delay
Restrict network reachability of APS delegation endpoints to trusted internal callers only
Rotate any permission-grant tokens issued by vulnerable instances and invalidate long-lived delegations
Review historical APSAdapter logs for prior exploitation attempts using forged delegation payloads

Patch Information

Upgrade to Network-AI version 5.13.4, which replaces the permissive default local verifier with proper cryptographic signature validation. Refer to the GitHub Security Advisory GHSA-3jf7-33vc-hgf4 for upstream fix details.

Workarounds

Replace the default local verifier with an explicit verifier configured against a known public key or HMAC secret
Disable the APSAdapter delegation endpoint until the patched version can be deployed
Place network-layer authentication, such as mTLS, in front of APS delegation interfaces to block unauthenticated callers

bash

# Verify installed Network-AI version and upgrade if below 5.13.4
network-ai --version
# Upgrade via package manager once the fixed release is available
# Example (adjust to your deployment method):
# pip install --upgrade "network-ai>=5.13.4"