CVE-2026-109332: Origin Validation Error in Jovancoding Network-AI

The vulnerability exists in Network-AI versions prior to 5.15.2 in the McpSseServer._handleRequest method within lib/mcp-transport-sse.ts. The server improperly reflects localhost Origins into the Access-Control-Allow-Origin header without verifying the bind interface. Consequently, if the server binds to a non-loopback address, an attacker can craft a page with a localhost Origin that a victim visits, enabling the attacker to perform cross-origin reads of unauthenticated endpoints like /health.

An attacker can exploit this origin validation error to bypass same-origin policy restrictions and read data from unauthenticated endpoints such as /health on the vulnerable server. The impact is limited to information disclosure of endpoints that do not require authentication. The CVSS 4.0 base score is 2.3, indicating low severity. There is no indication of privilege escalation, remote code execution, or other higher-impact consequences.

A fix is available in Network-AI version 5.15.2. Users should upgrade to version 5.15.2 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary based on the available data.