{"id":"CVE-2026-58482","sourceIdentifier":"security-advisories@github.com","published":"2026-07-20T17:18:15.997","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret."},{"lang":"es","value":"Network-AI, un orquestador multiagente de TypeScript/Node.js, tiene una característica distribuida, exportada y documentada llamada ’ApprovalInbox’ (’lib/approval-inbox.ts’). Es la superficie de red de la Puerta de Aprobación con intervención humana, que ’ApprovalGate’ utiliza para requerir aprobación humana explícita para operaciones de alto riesgo. El servidor HTTP que expone no tiene autenticación de ningún tipo y establece ’Access-Control-Allow-Origin: *’ en cada ruta, incluyendo las que cambian de estado ’POST /approvals/:id/approve’ y ’/deny’. Como resultado, en las versiones 5.0.0 a 5.12.1, cualquier parte que pueda enviar una solicitud HTTP al puerto de la bandeja de entrada - un proceso colocalizado, un contenedor/SSRF en el mismo host, un cliente remoto cuando el operador vincula una dirección no-loopback, o cualquier sitio web que el operador visite en un navegador (a través del CORS comodín) - puede enumerar las aprobaciones pendientes y aprobarlas, anulando todo el control con intervención humana y haciendo que la acción de alto riesgo protegida (p. ej., un comando de shell que el agente estaba reteniendo para revisión) se ejecute sin consentimiento. Este problema está solucionado en la v5.12.2. ’ApprovalInbox’ ahora acepta una opción ’secret’. Cuando se establece, los endpoints mutantes ’POST /:id/approve’ y ’POST /:id/deny’ requieren un encabezado ’Authorization: Bearer [secret]’, validado en tiempo constante con ’crypto.timingSafeEqual’. ’startServer()’ ya se vincula a ’127.0.0.1’ por defecto; los operadores que exponen la bandeja de entrada en una red deben establecer un secreto."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Jovancoding","product":"Network-AI","versions":[{"version":">= 5.0.0, < 5.12.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-20T17:33:19.793160Z","id":"CVE-2026-58482","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:network-ai:network-ai:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.12.2","matchCriteriaId":"78BA78F3-533A-4712-8CFD-9173282E8696"}]}]}],"references":[{"url":"https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mxjx-28vx-xjjj","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Patch","Vendor Advisory"]},{"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mxjx-28vx-xjjj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Patch","Vendor Advisory"]}]}