What’s Vulnerable › Vulnerabilities

CVE-2026-109330: Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-13
• Weakness: CWE-1385

Description

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.

Affected products

• Jovancoding Network-AI: from 5.0.0 before 5.15.2 — fixed in 5.15.2

How to fix

Upgrade to a fixed version: Jovancoding Network-AI 5.15.2. Check the vendor advisory for mitigations.

References

• https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-hr6v-mfxm-4438
• https://www.vulncheck.com/advisories/network-ai-5.0.0-before-5.15.2-cross-site-websocket-hijacking-via-dashboardserver
• https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-hr6v-mfxm-4438

Get alerted when CVE-2026-109330 or the next vulnerability affects your stack