CVE-2026-109330: medium-severity vulnerability in Jovancoding Network-AI
Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Jovancoding · Network-AIRelated CVEs — Jovancoding Network-AI
In the same product, most dangerous first.
CVE-2026-73614HIGHNetwork-AI ClaudeHookBridge Deny Pattern Bypass via TruncationEPSS 0.7%CVE-2026-73615HIGHNetwork-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote MismatchEPSS 0.7%CVE-2026-42856HIGHNetwork-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool callsEPSS 0.5%CVE-2026-64622CRITICALNetwork-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInboxEPSS 0.5%CVE-2026-54051CRITICALNetwork-AI has an an OS Command Injection issueEPSS 0.5%CVE-2026-48814CRITICALNetwork-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)EPSS 0.4%