Authorization Bypass in Network-AI npm Package CVE-2026-64622

CVE-2026-64622 impacts network-ai npm package versions 5.12.2 through 5.13.3, allowing unauthenticated actors to bypass authorization checks on specific GET read routes related to the ApprovalInbox. This flaw means that even when a secret is configured, sensitive approval request details become accessible without authentication. The affected routes, including /approvals/?status=all, /approvals/:id, /approvals/stats, and /approvals/sse, disclose full ApprovalEntry content such as action/target shell-command strings, file paths, justifications, and risk levels. Compounding the issue, all responses from these routes carry a hardcoded Access-Control-Allow-Origin: * header, which facilitates cross-origin data disclosure. This allows malicious websites, if visited by an operator, to potentially exfiltrate the exposed sensitive data. This vulnerability represents an incomplete fix for a previously identified issue (GHSA-mxjx-28vx-xjjj).

Attack Chain

1. An unauthenticated attacker identifies a network-ai instance running vulnerable versions 5.12.2 through 5.13.3.
2. The attacker sends an unauthenticated HTTP GET request to one of the vulnerable ApprovalInbox read routes, such as /approvals/?status=all, /approvals/:id, /approvals/stats, or /approvals/sse.
3. Due to the CVE-2026-64622 authorization bypass, the network-ai application fails to apply the configured checkAuth/secret.
4. The application responds with full ApprovalEntry content, which includes sensitive data like shell-command strings, file paths, justifications, and risk levels, without requiring authentication.
5. The response also contains a hardcoded Access-Control-Allow-Origin: * header, making the disclosed data vulnerable to cross-origin access.
6. If an operator of the network-ai application visits a malicious website, that website can initiate cross-origin requests to the vulnerable network-ai instance.
7. The malicious website successfully retrieves the sensitive approval data and exfiltrates it to an attacker-controlled server.

Impact

Successful exploitation of CVE-2026-64622 leads to unauthorized disclosure of highly sensitive information, including critical operational details like shell-command strings, internal file paths, and business justifications for approvals. This exposure can provide attackers with valuable intelligence for further attacks, potentially leading to privilege escalation, system compromise, or data manipulation. The hardcoded Access-Control-Allow-Origin: * header also enables severe privacy and data exfiltration risks, as any visited malicious website could programmatically extract this sensitive data, impacting organizations using the vulnerable versions.

Recommendation

• Patch CVE-2026-64622 by immediately updating the network-ai npm package to a version outside the affected range (i.e., higher than 5.13.3 or lower than 5.12.2 if applicable).
• Deploy the Sigma rule "Detect CVE-2026-64622 Exploitation Attempts on Network-AI" to your SIEM solution to alert on suspicious access patterns.
• Monitor web server access logs for unauthenticated GET requests to the /approvals/?status=all, /approvals/:id, /approvals/stats, and /approvals/sse endpoints, referencing the log source category webserver.
• Implement Web Application Firewall (WAF) rules to restrict or block unauthenticated access to the network-ai /approvals/* paths mentioned in the attack chain, if not required for legitimate operations.