Skip to content
Threat Feed

Product

Network-AI (<= 5.4.4)

1 brief RSS
high advisory

Network-AI Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret (CVE-2026-46701)

Network-AI is vulnerable to an unauthenticated cross-origin attack due to an empty default secret and permissive CORS configuration, allowing an attacker to lure a user to a malicious web page and invoke MCP tools like config_set, agent_spawn, and blackboard_write against a default-configured localhost server.

Network-AI cve cve-2026-46701 network cross-origin authentication bypass
2r 1t