CVE-2026-48814: Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)

Synopsis

An authentication bypass vulnerability in Network-AI, a TypeScript/Node.js multi-agent orchestrator, allows any remote caller to invoke the full set of MCP tools without credentials. The server's authorization check unconditionally returns true when the shared secret is empty, which is the default configuration, so no account or token is required to reach the API over the network. Successful exploitation gives an attacker full read and write access to agent configuration, blackboard state, and token stores across the orchestrator. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MCP SSE server over the network; any host that can send an HTTP request to the bound address (including via SSRF or a 0.0.0.0 bind) satisfies this condition.

• AuthenticationNot required

  No credentials are needed because the default empty-secret configuration causes _isAuthorized() to return true unconditionally for all requests.

• Victim interactionNot required

  Exploitation is fully server-side; no user action, click, or browser session is required.

• Attack complexityDetail

  The exploit is reliable and condition-free: the vulnerable default is active out of the box, and a standard HTTP request is sufficient to trigger the bypass.

Blast Radius

• An attacker reads all configuration values set via config_set, including any secrets, API keys, or environment parameters stored in the orchestrator.
• An attacker writes arbitrary data to the shared blackboard, corrupting shared agent state and poisoning inputs consumed by downstream agents.
• An attacker spawns new agents or reconfigures existing ones via agent_spawn, taking full control of orchestration logic and task routing.
• An attacker reads and manipulates token stores via the token_* tools, enabling session hijacking or quota exhaustion across connected services.