CVE-2026-46701

Description

Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

7.6 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

Effective score

7.6 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-46701

Linked Threat

CVE-2026-46701 — CVE-2026-46701

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-46019

Assigner

GitHub_M

Published

Jul 20, 2026, 4:33:43 PM

Updated

Jul 20, 2026, 7:07:31 PM

EUVD base score (CVSS 3.1)

7.6 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

EUVD-reported EPSS

0.2200

Vendors

Jovancoding

Products

Network-AI (< 5.4.5)

Aliases

GHSA-j3vx-cx2r-pvg8

ENISA description: Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''` at `bin/mcp-server.ts:89`), which causes `_isAuthorized` (`lib/mcp-transport-sse.ts:254`) to return `true` unconditionally for every request — no `Authorization` header is required. Simultaneously, `_handleRequest` sets `Access-Control-Allow-Origin: *` (`lib/mcp-transport-sse.ts:272`) on every response, so a cross-origin browser fetch can read the result without restriction. An unauthenticated attacker who can lure a user to a malicious web page can invoke all 22 exposed MCP tools — including `config_set`, `agent_spawn`, and `blackboard_write` — against a default-configured localhost server. Version 5.4.5 patches the issue.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-46701 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-46701 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review
  web:blog.qualys.com

  With Qualys Policy Audit's out-of-the-box mitigation or Compensatory Controls, which reduce the risk of a vulnerability being exploited because the remediation ( fix / patch ) cannot be done immediately, these security controls are not recommended by any industry standards, such as CIS and DISA-STIG.

  2026-05-26 03:00 UTC
• April 2026 Critical Patch Update Released | security - Oracle Blogs
  web:blogs.oracle.com

  For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.

  2026-05-26 03:00 UTC
• CISA Warns of Exploited Microsoft Defender 0-Day Flaws
  web:cyberpress.org

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

  2026-05-26 03:00 UTC
• CVE-2026-46701 | Security Details | Sonatype Guide
  web:guide.sonatype.com

  Technical security analysis for CVE-2026-46701 . CVSS 7.6 severity. View CVSS vectors, CWE classifications, and exploit maturity ratings.

  2026-05-26 03:00 UTC
• Microsoft January 2026 Security Updates (FYI) - Microsoft Q&A
  web:learn.microsoft.com

  January 2026 Security Updates This release consists of the following 112 Microsoft CVEs : Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations ? Windows Deployment Services CVE - 2026 -0386 SQL Server CVE - 2026 -20803 Windows Hello…

  2026-05-26 03:00 UTC
• April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft ...
  web:thehackernews.com

  Critical SAP, Adobe, Fortinet, and Microsoft flaws disclosed in April Patch Tuesday, enabling RCE and data theft risks.

  2026-05-26 03:00 UTC
• April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike
  web:www.crowdstrike.com

  Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

  2026-05-26 03:00 UTC
• Microsoft Technical Security Notifications
  web:www.microsoft.com

  Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.

  2026-05-26 03:00 UTC
• Oracle Critical Patch Update Advisory - April 2026
  web:www.oracle.com

  This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

  2026-05-26 03:00 UTC
• Microsoft fixes 167 security flaws in April, second biggest Patch ...
  web:www.pcworld.com

  This month's Patch Tuesday includes an actively exploited Office zero-day vulnerability and several critical RCE bugs in Windows and Remote Desktop.

  2026-05-26 03:00 UTC

Only Available for Registered Users. Sign in to view.