CVE-2026-120314 in Network-AI
Summary
by MITRE • 11/02/2026
Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Network-AI versions prior to 5.15.5 represents a critical failure in access control mechanisms within the A2AServer class. This flaw is classified as CWE-306, which denotes a Missing Authentication for Critical Function. The core issue arises from an improper implementation of security checks that rely on the presence of a configured secret key to enforce authentication requirements. When no secret is explicitly defined during the system's initialization or configuration phase, the server fails to validate incoming requests against any form of identity proof. This creates a state where the application operates in a permissive mode by default, effectively bypassing security controls that are intended to restrict access to sensitive operational endpoints.
The technical manifestation of this flaw allows unauthenticated actors to interact directly with the task management subsystem via JSON-RPC interfaces. Specifically, attackers can target three primary endpoints: tasks/send, tasks/get, and tasks/cancel. The lack of a required Bearer token means that any external entity on the network or internet, depending on exposure, can invoke these methods without providing credentials. This capability enables an attacker to submit arbitrary computational tasks through the send endpoint, retrieve execution results via the get endpoint, and interrupt ongoing processes using the cancel endpoint. Such unrestricted access transforms what should be a protected administrative interface into an open channel for exploitation.
The operational impact of this vulnerability is severe due to the nature of task-based systems which often handle sensitive data or perform resource-intensive operations. By exploiting tasks/send, an attacker can force the system to execute malicious code, consume excessive computational resources leading to denial of service conditions, or exfiltrate data if the tasks involve processing confidential information. The ability to use tasks/get allows for unauthorized disclosure of results that may contain proprietary algorithms, personal identifiable information, or other sensitive outputs generated by legitimate users. Furthermore, the capability to utilize tasks/cancel can disrupt critical business processes and degrade system availability by terminating important background jobs at will.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter if the executed tasks involve running scripts or commands on the host machine. It also relates to T1486 Data Encrypted for Impact in scenarios where malicious tasks are used to deploy ransomware or other destructive payloads. The absence of authentication serves as a foundational weakness that facilitates these downstream attacks, making it a high-priority target for exploitation by automated scanners and human attackers alike who seek initial access or privilege escalation within the application layer.
Mitigation strategies must focus on enforcing strict authentication policies regardless of configuration defaults. Administrators should ensure that a strong secret key is always configured in production environments to trigger the necessary validation logic within the A2AServer class. If possible, implementing multi-factor authentication for administrative interfaces adds an additional layer of defense against credential-based attacks even if secrets are compromised. Network-level controls such as firewalls and intrusion detection systems can also be employed to restrict access to these JSON-RPC endpoints only from trusted IP addresses or internal networks, thereby reducing the attack surface exposed to unauthenticated users. Upgrading to version 5.15.5 or later is essential as it resolves this missing authentication flaw by ensuring that security checks are applied consistently irrespective of secret configuration states.