CVE-2026-58482: CWE-352: Cross-Site Request Forgery (CSRF) in Jovancoding Network-AI
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret.
AI Analysis
Technical Summary
Network-AI, a TypeScript/Node.js multi-agent orchestrator, includes an ApprovalInbox HTTP server that requires explicit human approval for high-risk operations. Versions 5.0.0 through 5.12.1 expose this server without authentication and with a wildcard CORS policy, allowing any party able to send HTTP requests to the inbox port to enumerate and approve or deny pending approvals. This effectively bypasses the human approval gate, enabling execution of gated high-risk actions without consent. The vulnerability is classified as CWE-352 (CSRF) and CWE-862 (Missing Authorization). The issue is resolved in version 5.12.2 by introducing a secret token authorization mechanism for mutating endpoints and binding the server to 127.0.0.1 by default.
Potential Impact
An attacker who can send HTTP requests to the ApprovalInbox port can bypass the human-in-the-loop approval process by approving or denying pending requests without authorization. This leads to unauthorized execution of high-risk operations that were intended to require explicit human consent. The vulnerability impacts confidentiality minimally but has a high impact on integrity by allowing unauthorized state changes. Availability is not affected.
Mitigation Recommendations
A fix is available in Network-AI version 5.12.2. Operators should upgrade to this version, which introduces a secret-based authorization header requirement for the POST /:id/approve and POST /:id/deny endpoints, validated securely. Additionally, the server binds to 127.0.0.1 by default to prevent remote exposure. Operators exposing the inbox on a network must configure the secret option to secure the endpoints. Patch status is confirmed fixed in 5.12.2.
CVE-2026-58482: CWE-352: Cross-Site Request Forgery (CSRF) in Jovancoding Network-AI
Description
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Network-AI, a TypeScript/Node.js multi-agent orchestrator, includes an ApprovalInbox HTTP server that requires explicit human approval for high-risk operations. Versions 5.0.0 through 5.12.1 expose this server without authentication and with a wildcard CORS policy, allowing any party able to send HTTP requests to the inbox port to enumerate and approve or deny pending approvals. This effectively bypasses the human approval gate, enabling execution of gated high-risk actions without consent. The vulnerability is classified as CWE-352 (CSRF) and CWE-862 (Missing Authorization). The issue is resolved in version 5.12.2 by introducing a secret token authorization mechanism for mutating endpoints and binding the server to 127.0.0.1 by default.
Potential Impact
An attacker who can send HTTP requests to the ApprovalInbox port can bypass the human-in-the-loop approval process by approving or denying pending requests without authorization. This leads to unauthorized execution of high-risk operations that were intended to require explicit human consent. The vulnerability impacts confidentiality minimally but has a high impact on integrity by allowing unauthorized state changes. Availability is not affected.
Mitigation Recommendations
A fix is available in Network-AI version 5.12.2. Operators should upgrade to this version, which introduces a secret-based authorization header requirement for the POST /:id/approve and POST /:id/deny endpoints, validated securely. Additionally, the server binds to 127.0.0.1 by default to prevent remote exposure. Operators exposing the inbox on a network must configure the secret option to secure the endpoints. Patch status is confirmed fixed in 5.12.2.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-30T20:21:25.811Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5e56f62a4a8d598968a372
Added to database: 07/20/2026, 17:12:22 UTC
Last enriched: 07/20/2026, 17:27:25 UTC
Last updated: 07/21/2026, 05:32:31 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.