CVE-2026-58482

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58482", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-30T20:21:25.811Z", "datePublished": "2026-07-20T16:38:55.576Z", "dateUpdated": "2026-07-20T17:33:23.241Z"}, "containers": {"cna": {"title": "Network-AI: ApprovalInbox HTTP server has no authentication \u2014 anyone can approve pending agent actions", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mxjx-28vx-xjjj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mxjx-28vx-xjjj"}, {"name": "https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3", "tags": ["x_refsource_MISC"], "url": "https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3"}, {"name": "https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2"}], "affected": [{"vendor": "Jovancoding", "product": "Network-AI", "versions": [{"version": ">= 5.0.0, < 5.12.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:38:55.576Z"}, "descriptions": [{"lang": "en", "value": "Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port \u2014 a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) \u2014 can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret."}], "source": {"advisory": "GHSA-mxjx-28vx-xjjj", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mxjx-28vx-xjjj", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T17:33:19.793160Z", "id": "CVE-2026-58482", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T17:33:23.241Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58482", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T17:33:19.793160Z"}}}], "references": [{"url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mxjx-28vx-xjjj", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T17:33:11.687Z"}}], "cna": {"title": "Network-AI: ApprovalInbox HTTP server has no authentication \u2014 anyone can approve pending agent actions", "source": {"advisory": "GHSA-mxjx-28vx-xjjj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Jovancoding", "product": "Network-AI", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.12.2"}]}], "references": [{"url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mxjx-28vx-xjjj", "name": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mxjx-28vx-xjjj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3", "name": "https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2", "name": "https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port \u2014 a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) \u2014 can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:38:55.576Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58482", "state": "PUBLISHED", "dateUpdated": "2026-07-20T17:33:23.241Z", "dateReserved": "2026-06-30T20:21:25.811Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-20T16:38:55.576Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Network-AI", "vendor": "Jovancoding", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.12.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:network-ai:network-ai:*:*:*:*:*:*:*:*", "matchCriteriaId": "78BA78F3-533A-4712-8CFD-9173282E8696", "versionEndExcluding": "5.12.2", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port \u2014 a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) \u2014 can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret."}, {"lang": "es", "value": "Network-AI, un orquestador multiagente de TypeScript/Node.js, tiene una caracter\u00edstica distribuida, exportada y documentada llamada \u2019ApprovalInbox\u2019 (\u2019lib/approval-inbox.ts\u2019). Es la superficie de red de la Puerta de Aprobaci\u00f3n con intervenci\u00f3n humana, que \u2019ApprovalGate\u2019 utiliza para requerir aprobaci\u00f3n humana expl\u00edcita para operaciones de alto riesgo. El servidor HTTP que expone no tiene autenticaci\u00f3n de ning\u00fan tipo y establece \u2019Access-Control-Allow-Origin: *\u2019 en cada ruta, incluyendo las que cambian de estado \u2019POST /approvals/:id/approve\u2019 y \u2019/deny\u2019. Como resultado, en las versiones 5.0.0 a 5.12.1, cualquier parte que pueda enviar una solicitud HTTP al puerto de la bandeja de entrada - un proceso colocalizado, un contenedor/SSRF en el mismo host, un cliente remoto cuando el operador vincula una direcci\u00f3n no-loopback, o cualquier sitio web que el operador visite en un navegador (a trav\u00e9s del CORS comod\u00edn) - puede enumerar las aprobaciones pendientes y aprobarlas, anulando todo el control con intervenci\u00f3n humana y haciendo que la acci\u00f3n de alto riesgo protegida (p. ej., un comando de shell que el agente estaba reteniendo para revisi\u00f3n) se ejecute sin consentimiento. Este problema est\u00e1 solucionado en la v5.12.2. \u2019ApprovalInbox\u2019 ahora acepta una opci\u00f3n \u2019secret\u2019. Cuando se establece, los endpoints mutantes \u2019POST /:id/approve\u2019 y \u2019POST /:id/deny\u2019 requieren un encabezado \u2019Authorization: Bearer [secret]\u2019, validado en tiempo constante con \u2019crypto.timingSafeEqual\u2019. \u2019startServer()\u2019 ya se vincula a \u2019127.0.0.1\u2019 por defecto; los operadores que exponen la bandeja de entrada en una red deben establecer un secreto."}], "id": "CVE-2026-58482", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58482", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T17:33:19.793160Z", "version": "2.0.3"}}]}, "published": "2026-07-20T17:18:15.997", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mxjx-28vx-xjjj"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mxjx-28vx-xjjj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.12.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Network-AI", "source": "cna", "vendor": "Jovancoding"}, "product": "network-ai", "vendor": "jovancoding"}], "created": "2026-07-20T23:15:04.460192+00:00", "updated": "2026-07-30T19:15:04.751685+00:00", "vendors": ["jovancoding", "jovancoding$PRODUCT$network-ai"]}