CVE-2026-58482

Analyzed Analyzed - Analysis Complete

ApprovalInbox Unauthenticated Approval Bypass in Network-AI

Publication date: 2026-07-20

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-08-13

Generated

2026-08-30

AI Q&A

2026-07-20

EPSS Evaluated

2026-08-29

NVD

CVE-2026-58482

EUVD

EUVD-2026-46020

Affected Vendors & Products

Vendor	Product	Version / Range
network-ai	network-ai	From 5.0.0 (inc) to 5.12.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Network-AI's ApprovalInbox feature exposes an unauthenticated HTTP server with wildcard CORS, allowing any HTTP requester to approve or deny pending high-risk operations via POST /approvals/:id/approve and /deny endpoints. This bypasses the human-in-the-loop safety control entirely.

Detection Guidance

Check if Network-AI versions 5.0.0 to 5.12.1 are installed by running: npm list network-ai. Verify if the ApprovalInbox server is exposed on a non-loopback address by inspecting network bindings. Test CORS headers by sending a request to the inbox port and checking for Access-Control-Allow-Origin: *. Attempt to enumerate approvals via GET /approvals/ and check if mutating endpoints like POST /approvals/:id/approve or /deny accept requests without authentication.

Use curl to test endpoints: curl -i http://<host>:<port>/approvals/ to check for pending approvals and CORS headers.
Check server logs for unauthorized approval attempts or unexpected API calls to /approve or /deny endpoints.

Impact Analysis

Attackers can execute unauthorized high-risk actions like shell commands or file writes that were meant for human approval. They can also enumerate pending approvals and block legitimate approvals, compromising system integrity and availability.

Compliance Impact

This vulnerability likely violates compliance requirements for access control and audit logging in GDPR (data protection) and HIPAA (health data). It removes mandatory human oversight for high-risk operations, failing security controls for sensitive data processing.

Mitigation Strategies

Upgrade Network-AI to version 5.12.2 or later immediately to patch the vulnerability. If upgrading is not possible, restrict the ApprovalInbox server to bind only to 127.0.0.1 by configuring the server settings. Add a secret key for the ApprovalInbox and ensure all mutating endpoints require the Authorization: Bearer <secret> header.

Disable or firewall the ApprovalInbox port if it is exposed to untrusted networks or the internet.
Review and revoke any unauthorized approvals that may have been granted due to this vulnerability.

Hi! I’m here to help you understand CVE-2026-58482. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70