CVE-2026-48814: Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests

This is an incomplete fix of the earlier advisory CVE-2026-46701. Version 5.4.5 limited Access-Control-Allow-Origin to localhost origins in lib/mcp-transport-sse.ts, which stops drive-by browser calls. It left the root cause. In bin/mcp-server.ts the secret comes from NETWORK_AI_MCP_SECRET and falls back to an empty string. _isAuthorized() returns true when the secret is empty. On a non-loopback bind, listen() only writes a warning to stderr and then listens anyway.

The researcher's proof of concept sent a POST /mcp with no credentials and no Origin header, as curl or an SSRF would. The server returned HTTP 200 and dispatched config_set. So the server runs unauthenticated by default.

The attacker needs a non-browser path to the port. That means an SSRF bug on the same host, or an operator who bound the server to a non-loopback address, such as in Docker or on a remote host. They then reach 22 tools, including config_set, agent_spawn, blackboard_write and the token_* tools. That lets them change the agent system's configuration, start agents and write shared state. The CVSS 3.1 score is 9.1.

npm package network-ai 5.7.1 and earlier, when the SSE MCP server (McpSseServer) runs without NETWORK_AI_MCP_SECRET set. Stdio mode (--stdio) does not involve this server. Check the version:

npm ls network-ai

Also check whether the server binds to anything other than loopback, and whether the secret variable is set in its environment.

Upgrade to network-ai 5.7.2.

npm install [email protected]

Per the release notes, _isAuthorized() now returns false when the secret is empty. listen() throws an error if McpSseServerOptions.secret is empty, so the server no longer starts open. McpSseTransport gets an optional secret parameter and sends an Authorization: Bearer header when it is set. Set a strong secret before upgrading so your clients keep working. On older versions, set a non-empty NETWORK_AI_MCP_SECRET, bind to loopback and block the port from other hosts.

Review the SSE server's request logs for POST /mcp calls with no Authorization header, especially ones that call config_set, agent_spawn or blackboard_write. On startup, look for the stderr warning about a non-loopback bind, which means the server was open to the network. Check agent and configuration state for changes nobody made.

Advisory / Disclosure

Network-AI — CVE-2026-46701 fix is incomplete: the "Empty Default Secret" unauth path survives

Target: Jovancoding/Network-AI (npm network-ai), latest v5.7.1 Status: the advisory ("Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret") named three flaws. The fix (5.4.5) closed the CORS flaw (Access-Control-Allow-Origin is now set only for localhost origins), but left the empty-default-secret flaw the title is about: the SSE MCP server still defaults to an empty secret, _isAuthorized() still returns true when the secret is empty, and a non-loopback bind only warns. So the server still runs fully unauthenticated by default — any non-browser caller (curl, SSRF, or a 0.0.0.0 bind) can invoke all 22 MCP tools (config_set, agent_spawn, blackboard_write, token_*) with no credentials. Class: CWE-306/CWE-862 Missing Authentication — incomplete fix. Methodology: M1 incomplete-fix audit (anchor = the 5.4.5 fix; sibling-walk on latest v5.7.1, executed). Severity: High (matches parent; the browser amplifier is removed, so exploitation now needs non-browser reach — SSRF or a non-loopback bind, which the fix only warns about).

What the fix did and didn't do (verified on latest v5.7.1)

| advisory flaw | latest v5.7.1 |
| wildcard CORS (`ACAO: *`) | **FIXED** — `lib/mcp-transport-sse.ts` sets `ACAO` only when `origin` matches `^https?://(localhost\|127\.0\.0\.1)(:\d+)?$` |
| empty default secret | **NOT FIXED** — `bin/mcp-server.ts`: `secret: process.env['NETWORK_AI_MCP_SECRET'] ?? ''` |
| `_isAuthorized` open on empty secret | **NOT FIXED** — `if (!this._opts.secret) return true;` |
| require secret / refuse unauth bind | **NOT DONE** — `listen()` only `process.stderr.write('… WARNING …')` on non-loopback bind, then listens anyway |

The advisory's remediation #1 ("Require a non-empty secret at startup … process.exit(1)") was not implemented.

PoC (executed against the latest source, v5.7.1) — poc/legend-networkai-empty-secret.ts

Instantiates the real McpSseServer from the latest lib/ with a mock bridge and the default (empty) secret, then issues requests (run-log poc/run-log.txt):

POST /mcp  no-auth, no-origin (curl/SSRF) -> HTTP 200, dispatched=true
   body: {"jsonrpc":"2.0","id":1,"result":{"executed":true,"tool":"config_set"}}
POST /mcp  Origin: evil.example.com        -> ACAO=undefined   (CORS half fixed)

The no-auth request passes _isAuthorized and reaches handleRPC (tool dispatched) — i.e. unauthenticated tool invocation persists on the latest release; only the browser-CORS read amplifier was removed.

Run: from a v5.7.1 checkout, npm i then npx ts-node --transpile-only poc/legend-networkai-empty-secret.ts.

Recommended fix

Implement the advisory's remediation #1: refuse to start SSE mode with an empty secret (unless --stdio), and/or change _isAuthorized to fail closed (an empty configured secret should mean "deny", not "allow"). The CORS allowlist alone does not authenticate non-browser callers.

Precondition / honesty

With CORS now localhost-only, the drive-by *browser* attack is mitigated. The residual requires a non-browser path to the port: an SSRF on the host, or the operator binding to a non-loopback address (Docker/remote), which the fix only warns about. The empty secret remains the shipped default and _isAuthorized still authorizes it.

Credits

@Kai Aizen / @SnailSploit — https://snailsploit.com