CVE-2026-109330 in Network-AI
Summary
by MITRE • 10/12/2026
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
Network-AI version 5.0.0 prior to release 5.15.2 contains a critical cross-site WebSocket hijacking vulnerability within its DashboardServer component. This flaw stems from the handleUpgrade function failing to perform any validation of the Origin header or authentication tokens during the establishment of WebSocket connections. In standard web security practices, servers must verify that incoming requests originate from trusted domains and are authenticated by authorized users to prevent unauthorized access. The absence of these checks allows remote attackers to bypass traditional browser same-origin policies, which typically restrict how scripts on one page can interact with resources on another origin. By exploiting this lack of validation, an attacker can trick a victim who is actively logged into the Network-AI dashboard into establishing a WebSocket connection back to their own local instance from a malicious external webpage.
The operational impact of this vulnerability is severe as it enables the exfiltration of sensitive internal network topology data and user credentials without direct interaction beyond visiting a crafted URL or loading a compromised page. When an authenticated victim loads the attacker-controlled page, JavaScript code can initiate a WebSocket connection to the loopback address where the dashboard server resides. Because the server does not reject this request based on origin mismatch or missing tokens, it accepts the connection and allows data transmission. The attacker gains real-time access to live agent topology information, including specific agent identifiers, assigned roles, detailed task descriptions, and token budgets associated with those agents. This level of visibility provides a comprehensive map of the organization's AI infrastructure, revealing how autonomous agents are configured, what tasks they perform, and their operational limits.
From a classification perspective, this vulnerability aligns closely with CWE-942, which describes Cross-Site WebSocket Hijacking, as well as CWE-352 for Cross-Site Request Forgery principles applied to persistent connections. In the context of the MITRE ATT&CK framework, this exploit technique relates to T1078 Valid Accounts and potentially T1005 Data from Local System, depending on how the exfiltrated data is utilized in subsequent attack phases. The ability to read live topology allows attackers to understand the structure of the AI ecosystem, facilitating more targeted attacks against specific high-value agents or attempting privilege escalation by manipulating task assignments based on revealed role hierarchies.
Mitigation for this vulnerability requires immediate patching to version 5.15.2 or later where these validation checks have been implemented. For environments unable to update immediately, network-level controls such as restricting WebSocket connections from external origins via firewall rules can provide partial protection. Additionally, implementing strict Content Security Policy headers that limit the sources of valid WebSocket connections and ensuring all API endpoints require explicit authentication tokens in both HTTP upgrade requests and subsequent frames are essential defensive measures. Organizations should also monitor for unusual outbound WebSocket traffic originating from dashboard servers to detect potential exploitation attempts in real time.