High severity7.3NVD Advisory· Published Nov 2, 2026· Updated Nov 2, 2026

CVE-2026-120314

Description

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.

Affected products

Jovancoding/Network AIllm-fuzzy
Range: <5.15.5

Patches

Vulnerability mechanics

References

github.com/Jovancoding/Network-AI/security/advisories/GHSA-qvf5-9prv-7r9cnvd
www.vulncheck.com/advisories/network-ai-5.14.0-before-5.15.5-missing-authentication-in-a2aserver-task-operationsnvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000