PT-2026-50534 · Unknown · Network-Ai

Snailsploit · CVE-2026-48814 · Published 2026-05-21 · Updated 2026-06-19

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Network-AI versions prior to 5.7.2

Description The MCP SSE server allows unauthenticated cross-origin MCP tool invocation because the server defaults to an empty secret and the isAuthorized() function returns true when the secret is empty. While a previous update restricted CORS to localhost origins, the server remains unauthenticated by default for non-browser callers, such as curl or SSRF. This allows unauthorized access to 22 MCP tools, including config set, agent spawn, blackboard write, and token * functions, especially when a non-loopback bind is used.

Recommendations Update to version 5.7.2.

Exploit

Fix

Origin Validation Error

Missing Authentication

Weakness Enumeration

CWE-346

CWE-306

Related Identifiers

CVE-2026-48814

GHSA-J3VX-CX2R-PVG8

GHSA-R78R-RWRF-RJWP

Affected Products

Network-Ai

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48814.json · Exploit
• 🔥 https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-r78r-rwrf-rjwp · Exploit
• https://osv.dev/vulnerability/CVE-2026-48814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48814 · Security Note
• https://osv.dev/vulnerability/GHSA-r78r-rwrf-rjwp · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j3vx-cx2r-pvg8 · Vendor Advisory
• https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-j3vx-cx2r-pvg8 · Note
• https://github.com/Jovancoding/Network-AI · Note
• https://github.com/Jovancoding/Network-AI/releases/tag/v5.7.2 · Note
• https://twitter.com/CVEnew/status/2067350979750617222 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2067402018172395698 · Twitter Post
• https://t.me/CVEtracker/57156 · Telegram Post
• https://github.com/advisories/GHSA-j3vx-cx2r-pvg8 · Note
• https://t.me/cveNotify/170709 · Telegram Post