GitHub Security Advisory: GHSA-fj4g-2p96-q6m3
Package: network-ai (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 5.1.2
Patched in: 5.1.3

Summary: Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls

Details:
# Security Advisory: Missing Authentication for Critical Function in `Jovancoding/Network-AI`

| Field | Value |
|---|---|
| Project | `Jovancoding/Network-AI` |
| Repository | https://github.com/Jovancoding/Network-AI |
| Affected commit | `c344f2053eb0d49395988f803bf92f2a86b2a0d0` |
| Affected tested version | `5.1.2` |
| Vulnerability type | CWE-306: Missing Authentication for Critical Function |
| Severity | High |
| Authentication required | None |
| Default network exposure | Bind address `0.0.0.0` |
| Reporter validation date | 2026-04-21 |

## Summary

The MCP HTTP transport accepts JSON-RPC `tools/call` requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is `0.0.0.0`. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools — including reading and mutating the live orchestrator configuration, listing registered agents, dispatching agents, creating/revoking security tokens, and adjusting global budget ceilings.

## Affected Code

- `bin/mcp-server.ts:75` — server binds to `0.0.0.0` by default.
- `lib/mcp-transport-sse.ts:155` — `handleRPC()` dispatches `tools/call` directly to the provider's `call(toolName, toolArgs)`.
- `lib/mcp-transport-sse.ts:379` — `_handlePost()` parses the JSON-RPC body and calls `this._bridge.handleRPC(rpc)` with no auth check.
- `lib/mcp-tools-control.ts:80` — `config_get` exposes live runtime configuration.
- `lib/mcp-tools-control.ts:197` — `agent_list` exposes registered agents.
- `lib/mcp-tools-control.ts:231` — `config_set` mutates runtime configuration in place: `this._config[key] = parsed`.

## Proof of Concept

The PoC was executed against a local Docker build of the affected commit, bound to `http://localhost:13001`. **No authentication header was sent.** All inner-JSON excerpts below are decoded from the JSON-RPC `result.content[0].text` field for readability; the raw wire transcripts (which contain the literal escaped JSON-RPC envelope) are in `evidence/`.

### Step 1 — list exposed tools (unauthenticated)

```bash
curl http://localhost:13001/tools
```

`HTTP/1.1 200 OK` — body returned 22 tools. Privileged tools observed in the inventory include:

- `config_get`, `config_set` — read and mutate live orchestrator configuration
- `agent_list`, `agent_spawn`, `agent_stop` — enumerate, dispatch, and stop agents
- `token_create`, `token_revoke` — mint and revoke security tokens
- `budget_set_ceiling` — adjust the global token budget ceiling
- `fsm_transition` — drive finite-state-machine transitions
- `blackboard_write`, `blackboard_delete` — mutate the shared blackboard

Full transcript: `evidence/01_get_tools.txt`.

### Step 2 — read live configuration (unauthenticated)

```bash
curl http://localhost:13001/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"config_get","arguments"