Network-AI (5.14.0 - 5.15.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/network-ai-5.14.0---5.15.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 20:29:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSecurity Control Bypass in Network-AI ClaudeHookBridgehttps://feed.craftedsignal.io/briefs/2026-10-network-ai-bypass/Mon, 12 Oct 2026 20:29:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-network-ai-bypass/Network-AI versions 5.14.0 through 5.15.1 contain a security control bypass in the ClaudeHookBridge PreToolUse hook, enabling prompt-injected agents to execute arbitrary scripts or deploy web shells.Network-AI versions 5.14.0 through 5.15.1 are vulnerable to a security control bypass flaw identified as CVE-2026-109331 within the ClaudeHookBridge PreToolUse hook. The vulnerability stems from improper input validation logic where the hook only evaluates the first candidate field of a request against established deny patterns. An attacker can leverage this limitation by using prompt injection to craft malicious inputs that hide dangerous payloads, such as web shell content or unauthorized script parameters, in secondary fields while keeping the primary field benign. Successful exploitation of this vulnerability allows an attacker to bypass security filters, leading to arbitrary script execution or unauthorized file modifications on the appliance. Defenders should prioritize patching affected instances to version 5.15.2 or later to address the validation logic flaw.

Attack Chain

  1. Attacker identifies a target running Network-AI (v5.14.0 - 5.15.1).
  2. Attacker crafts a prompt injection sequence designed to interact with the ClaudeHookBridge.
  3. Attacker constructs a multi-field request where the first field satisfies benign deny-pattern checks.
  4. Attacker inserts malicious payload (e.g., shell script or web shell code) into a secondary field like "Write content" or an MCP script parameter.
  5. The ClaudeHookBridge PreToolUse hook parses the request and validates only the primary field.
  6. The validation logic ignores the secondary field due to the flawed implementation, allowing the malicious request to pass.
  7. The system processes the request, executing the script or writing the malicious file to the filesystem.
  8. Attacker gains unauthorized persistence or execution on the network appliance.

Impact

The vulnerability poses a high risk to organizations utilizing Network-AI, as it allows attackers to bypass core security controls meant to limit agent capabilities. If exploited, an attacker could achieve unauthorized code execution, deploy web shells for persistent access, or modify critical system files. This vulnerability affects all environments running the vulnerable software versions, potentially impacting a wide range of deployments that rely on these security hooks for input sanitization.

Recommendation

  • Upgrade Network-AI to version 5.15.2 or later immediately to resolve the validation logic flaw in the ClaudeHookBridge PreToolUse hook.
  • Audit logs for anomalous activity involving the ClaudeHookBridge component, focusing on requests where multiple input fields or parameters are present in a single interaction.
  • Restrict the deployment of AI agents in production environments to those with validated, secure integration configurations until patching is completed.
]]>highadvisory