CVE-2026-120314

    Dashboard / Vulnerabilities / CVE-2026-120314

    CVE-2026-120314

    Published: 2 Nov 2026Last Modified: 7 Nov 2026

    Summary: Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations

    Details: Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120314.json, https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qvf5-9prv-7r9c, https://nvd.nist.gov/vuln/detail/CVE-2026-120314, https://www.vulncheck.com/advisories/network-ai-5.14.0-before-5.15.5-missing-authentication-in-a2aserver-task-operations

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ff375adc3d19353f546f6c26ea3572ceab2d868a
    Fixed -7977f309a620e5d8300e8c067e679ebbbb77d7e1

    Affected versions

    v5.15.4
    v5.15.3
    v5.15.2
    v5.15.1
    v5.15.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-120314 | CVE-DB