CVE-2026-109330GHSA-hr6v-mfxm-4438
Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer
Jovancoding Network-AI
CVSS
5.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.
Text from CVE List
Affected versions 3
- Network-AIaffected: 5.0.0 before 5.15.2CVE List
- Network-AIunaffected: 5.15.2CVE List
- network-ai, npm<= 5.15.1GitHub