CVE-2026-109330: Missing Origin Validation in WebSockets in Jovancoding Network-AI

CVE-2026-109330 describes a vulnerability in Jovancoding Network-AI's DashboardServer where the handleUpgrade function fails to perform Origin or token validation on incoming WebSocket upgrade requests. This lack of validation enables cross-site WebSocket hijacking, whereby an attacker can lure a victim into visiting a malicious webpage that opens a WebSocket connection to the victim's local dashboard server. Through this connection, the attacker can exfiltrate sensitive live agent topology information such as agent identifiers, roles, task descriptions, and token budgets. The vulnerability affects versions from 5.0.0 up to but excluding 5.15.2.

An attacker can remotely exploit this vulnerability by convincing a victim to visit a malicious webpage, which then opens a WebSocket connection to the victim's local dashboard server. This allows the attacker to read sensitive live agent topology data, potentially exposing internal agent configurations and operational details. The vulnerability does not require privileges or authentication and involves user interaction (UI required). The CVSS 4.0 base score is 5.3, indicating a medium severity impact with network attack vector and low complexity.

A fix is available in Jovancoding Network-AI version 5.15.2 or later. Users should upgrade to version 5.15.2 or above to remediate this vulnerability. Until patched, restricting access to the dashboard server and avoiding visiting untrusted webpages while the dashboard is running may reduce exposure. Patch status is confirmed by the affectedVersions field indicating the vulnerability is fixed starting at 5.15.2.