Threats tagged 'ghsa-vw9p-p26h-v56v'

Network-AI versions from 5.14.0 up to but not including 5.15.5 contain a missing authentication vulnerability in the A2AServer class. This flaw allows unauthenticated attackers to perform task operations such as executing tasks, reading results, and canceling tasks by sending JSON-RPC requests without requiring a Bearer token when no secret is configured.