CVE-2026-58482

Executive Summary

Business Impact: This vulnerability affects organizations using Network-Ai, a TypeScript/Node.js multi-agent orchestrator, particularly those leveraging the human-in-the-loop ApprovalGate feature for high-risk operations. Industries deploying autonomous agent systems (e.g., DevOps, finance, security operations) are at risk. The likely attacker is any party who can send an HTTP request to the ApprovalInbox port — including a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS).

Vulnerability Class & Attack Vector: This is a Missing Authentication for Critical Function (CWE-306) vulnerability. The ApprovalInbox HTTP server exposes state-changing endpoints (POST /approvals/:id/approve and /deny) with no authentication and a wildcard CORS policy (Access-Control-Allow-Origin: *). The attack vector is network-accessible, requiring no authentication.

Urgency Assessment: The CVSS score is 5.9 (Medium). The EPSS exploitation probability is 0.0%, indicating no observed exploitation in the wild as of the publication date. However, the vulnerability is trivial to exploit and defeats a critical security control (human-in-the-loop approval). The lack of a public PoC does not reduce the risk for organizations with exposed instances.

Key Facts:

• Vendor: Network-Ai
• Affected Versions: 5.0.0 through 5.12.1
• Patch: Fixed in v5.12.2
• CISA KEV: Not listed.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Qualitative Severity: Medium (CVSS 5.9). While the integrity impact is High, the requirement for user interaction (UI:R) and the Low confidentiality impact bring the score down.

EPSS Interpretation: An EPSS score of 0.0% means the model predicts a negligible probability of exploitation in the wild within the next 30 days. This is typical for a newly published CVE with no known exploits. It does not reflect the technical ease of exploitation.

Historical Comparison: This vulnerability is similar to CVE-2023-44487 (HTTP/2 Rapid Reset) in that it involves a missing authentication check on a critical function, but the attack vector is different. It is more directly comparable to CVE-2022-22965 (Spring4Shell) in that a missing authorization check on a state-changing endpoint can lead to code execution, though the mechanism is simpler.

Temporal & Environmental Scores: The temporal score is currently equal to the base score (5.9) due to no official patch confirmation or exploit code. The environmental score can be higher (up to 7.4) if the ApprovalInbox is exposed to the internet (AV:N, UI:N) and the high-risk actions involve critical infrastructure.

Technical Deep Dive & Attack Mechanics

Step-by-Step Exploitation:

1. Discovery: An attacker identifies a Network-Ai instance with the ApprovalInbox feature enabled. This can be done by scanning for the default port (not specified, but typically a high port) or by observing CORS headers in a browser.
2. Enumeration: The attacker sends a GET /approvals request to the ApprovalInbox HTTP server. The server responds with a list of pending approvals, including their IDs and the associated high-risk operations (e.g., shell commands).
3. Approval/Denial: The attacker sends a POST /approvals/:id/approve or POST /approvals/:id/deny request to approve or deny a specific pending approval.
4. Execution: If approved, the ApprovalGate component executes the previously gated high-risk action (e.g., running a shell command) without the operator's consent.

Root Cause Analysis: The developer created a feature (ApprovalInbox) that exposes state-changing HTTP endpoints without implementing any authentication mechanism. The Access-Control-Allow-Origin: * header was set for convenience, inadvertently allowing cross-origin requests from any website.

Attack Surface:

• Port: The HTTP server port (not specified, but configurable).
• Protocol: HTTP.
• Endpoints: GET /approvals, POST /approvals/:id/approve, POST /approvals/:id/deny.

Pre-conditions:

• The ApprovalInbox feature must be enabled.
• The attacker must have network access to the ApprovalInbox port.
• For the CORS-based attack, the operator must visit a malicious website while the ApprovalInbox is running.

Attack Variants:

1. Direct Network Access: An attacker on the same network or with SSRF capabilities can directly interact with the ApprovalInbox.
2. Cross-Origin Attack: An attacker hosts a malicious website that uses JavaScript to make cross-origin requests to the ApprovalInbox (due to the wildcard CORS policy). If the operator visits this site, the requests are executed in the context of the operator's browser.

Why Standard Defenses May Fail:

• WAF: A Web Application Firewall may not block requests to /approvals if it is not a known attack pattern.
• Network Segmentation: If the ApprovalInbox is bound to a non-loopback address, it may be accessible from other network segments.
• Browser Security: The wildcard CORS policy bypasses the Same-Origin Policy, making the browser-based attack trivial.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (v5.0.0 - v5.12.1):

// lib/approval-inbox.ts (simplified)
import express from 'express';

const app = express();
app.use((req, res, next) => {
    res.setHeader('Access-Control-Allow-Origin', '*');
    next();
});

app.get('/approvals', (req, res) => {
    // Returns list of pending approvals
    res.json(pendingApprovals);
});

app.post('/approvals/:id/approve', (req, res) => {
    // Approves the approval without any authentication
    approveApproval(req.params.id);
    res.sendStatus(200);
});

app.post('/approvals/:id/deny', (req, res) => {
    // Denies the approval without any authentication
    denyApproval(req.params.id);
    res.sendStatus(200);
});

Patched Code (v5.12.2):

// lib/approval-inbox.ts (simplified)
import express from 'express';
import crypto from 'crypto';

const app = express();
const secret = process.env.APPROVAL_INBOX_SECRET; // New option

app.use((req, res, next) => {
    // CORS is now more restrictive or configurable
    next();
});

// Middleware to validate secret on mutating endpoints
function requireAuth(req, res, next) {
    const providedSecret = req.headers['authorization']?.replace('Bearer ', '');
    if (!secret || !providedSecret) {
        return res.sendStatus(401);
    }
    // Constant-time comparison
    if (crypto.timingSafeEqual(Buffer.from(providedSecret), Buffer.from(secret))) {
        next();
    } else {
        res.sendStatus(403);
    }
}

app.get('/approvals', (req, res) => {
    // Still returns list, but now requires auth for mutating actions
    res.json(pendingApprovals);
});

app.post('/approvals/:id/approve', requireAuth, (req, res) => {
    approveApproval(req.params.id);
    res.sendStatus(200);
});

app.post('/approvals/:id/deny', requireAuth, (req, res) => {
    denyApproval(req.params.id);
    res.sendStatus(200);
});

What the Patch Changes:

• Introduces a secret option.
• Adds a requireAuth middleware that validates the Authorization: Bearer <secret> header.
• Uses crypto.timingSafeEqual to prevent timing attacks.
• The startServer() function now binds to 127.0.0.1 by default.

Regression Considerations: The patch is backward-compatible if the secret option is not set (the endpoints will return 401). Operators must configure the secret and update any legitimate clients to include the Authorization header.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-20T17:18:15.997
• Estimated Discovery: Likely discovered by internal security review or responsible disclosure prior to publication.
• Disclosure Process: The CVE was published by the CNA (Network-Ai). The vendor released a fix in v5.12.2.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-20.
• CISA KEV: Not listed.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is attractive to a wide range of threat actors due to its simplicity:

• Script Kiddies: Can use simple HTTP requests to exploit.
• Ransomware Operators: Could use this to approve malicious commands that deploy ransomware.
• Nation-State Actors: Could use this for covert operations in environments with autonomous agents.

Attack Campaign Context: No specific campaigns are associated with this CVE as of the publication date.

Geographic Targeting: No specific geographic targeting patterns are known.

Industry Verticals Most at Risk:

• DevOps & CI/CD: Where Network-Ai might be used to automate deployments.
• Financial Services: Where high-risk operations (e.g., fund transfers) might be gated.
• Security Operations: Where autonomous agents might execute security-critical commands.

Connection to Similar Vulnerabilities: This is a classic example of CWE-306 (Missing Authentication for Critical Function), similar to vulnerabilities found in many IoT devices and web applications where developers expose APIs without proper authentication.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Docker Environment:

   docker run -d --name network-ai-vuln -p 3000:3000 network-ai/network-ai:5.12.1
   

2. Verify Installation:

   curl http://localhost:3000/approvals
   

Prerequisites:

• Network-Ai v5.0.0 to v5.12.1.
• The ApprovalInbox feature must be enabled (default in these versions).
• Network access to the ApprovalInbox port.

Exploitation Walkthrough:

1. Enumerate Pending Approvals:

   curl http://target:3000/approvals
   

   Expected Output:

   [
       {
           "id": "abc123",
           "action": "Execute shell command: rm -rf /data",
           "status": "pending"
       }
   ]
   

2. Approve a High-Risk Action:

   curl -X POST http://target:3000/approvals/abc123/approve
   

   Expected Output: HTTP 200 OK. The gated action (e.g., rm -rf /data) will be executed.

Post-Exploitation:

• The attacker can approve or deny any pending approval, leading to unauthorized execution of high-risk operations.
• This can be used to execute arbitrary shell commands, modify data, or disrupt services.

Blue Team Section

Detection:

• Log Entries: Look for HTTP requests to /approvals, /approvals/:id/approve, or /approvals/:id/deny from unexpected IP addresses.
• Network Traffic: Monitor for requests with Origin headers from unknown domains (CORS attack).
• Endpoint Indicators: Unexpected execution of shell commands or other high-risk operations that were previously gated.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Detection Engineering

YARA Rule

rule CVE-2026-58482_Detection {
    meta:
        description = "Detects exploitation of CVE-2026-58482 in Network-Ai"
        author = "Valters IT Hub"
        date = "2026-07-20"
        reference = "https://www.valtersit.com/cve/cve-2026-58482"
    strings:
        $s1 = "POST /approvals/" ascii wide nocase
        $s2 = "Access-Control-Allow-Origin: *" ascii wide nocase
        $s3 = "approve" ascii wide nocase
        $s4 = "deny" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule (SIEM)

title: CVE-2026-58482 Network-Ai Exploitation Detection
id: f352fdef-ed8a-4d38-876e-b8ef4ba5baa8
status: experimental
description: Detects exploitation attempts targeting CVE-2026-58482 in Network-Ai
author: Valters IT Hub
date: 2026-07-20
references:
    - https://www.valtersit.com/cve/cve-2026-58482
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|startswith: '/approvals/'
        cs-uri-stem|endswith:
            - '/approve'
            - '/deny'
    condition: selection
falsepositives:
    - Legitimate administrative activity if the operator has configured a secret and is using it correctly.
level: high

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-58482 Network-Ai ApprovalInbox Exploitation"; flow:to_server; http.method; content:"POST"; http.uri; content:"/approvals/"; pcre:"/\/(approve|deny)$/"; classtype:attempted-admin; sid:1000001; rev:1;)

Elastic (EQL) Query

sequence by host.id with maxspan=1m
  [network where process.name == "node" and destination.port == 3000 and network.protocol == "http"]
  [http where http.request.method == "POST" and http.request.uri == "/approvals/*/approve" or http.request.uri == "/approvals/*/deny"]

Splunk SPL Query

index=web sourcetype=access_combined
  method=POST
  uri_path IN ("/approvals/*/approve", "/approvals/*/deny")
  | stats count by src_ip, uri_path, _time
  | where count > 1

Wazuh Rule

<rule id="100001" level="12">
  <if_group>web|accesslog</if_group>
  <field name="url">/approvals/</field>
  <field name="method">POST</field>
  <description>CVE-2026-58482 - Network-Ai ApprovalInbox exploitation attempt</description>
  <group>cve_2026_58482,network_ai,exploitation,</group>
</rule>

Remediation & Mitigation

Immediate Actions (0-24 hours):

1. Apply the Patch: Upgrade to Network-Ai v5.12.2.

   npm update network-ai@5.12.2
   

2. If Patching is Not Possible:
   • Network-Level Mitigation: Use a firewall to restrict access to the ApprovalInbox port to only trusted IP addresses.
   • WAF Rule: Block requests to /approvals with POST methods.
   • Disable the Feature: If the ApprovalInbox is not required, disable it in the configuration.

Short-term (1-7 days):

1. Configuration Hardening: Ensure the ApprovalInbox is bound to 127.0.0.1 only. If it must be exposed, configure a strong secret.
2. Monitoring: Implement the detection rules provided above to monitor for exploitation attempts.
3. Vulnerability Scanning: Use a tool like npm audit to confirm the patched version is installed.

   npm audit
   

Long-term:

1. Architecture Changes: Implement a reverse proxy with authentication (e.g., OAuth2) in front of the ApprovalInbox.
2. Security Control Improvements: Add rate limiting and logging to all state-changing endpoints.
3. Developer Training: Educate developers on the importance of authentication for all API endpoints, especially those that change state.

Validation:

• Check the version of Network-Ai installed:

  npm list network-ai
  

• Verify that the secret option is configured and that requests without the Authorization header return a 401 status.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58482
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-58482
• Vendor advisory: See vendor security page
• OSV: https://osv.dev/vulnerability/CVE-2026-58482
• Related CWE: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-20 | https://www.valtersit.com/cve/cve-2026-58482