MEDIUM 6.9 NVD
CVE-2026-120314
Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task
Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.
References
- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qvf5-9prv-7r9c
- https://www.vulncheck.com/advisories/network-ai-5.14.0-before-5.15.5-missing-authenticatio
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-11-02 via NVD.
vulnfeed aggregates 15261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.