CVE-2026-64622General

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-07-20); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

Disclosure

150.0%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-64622

Classification over time

Date	Total	Labels

2026-07-20	1	General1
2026-07-31	1	Disclosure1

Full discourse2 posts

DFIR Lab@DFIR_Lab81d
Disclosure
🚨 HIGH Severity: CVE-2026-64622 (CVSS 7.5) Network-AI npm package (v5.12.2-5.13.3) bypasses auth checks, exposing approval requests with shell commands & file paths to unauthenticated actors. CORS misconfiguration enables cross-origin attacks. #CVE #Vulnerability #PatchNow https://t.co/tFBsRzyp2e
Post summary
The tweet announces high‑severity CVE-2026-64622, a vulnerability in the Network‑AI npm package that bypasses authentication and exposes shell commands, urging users to patch but offering no detailed fix.
0000050
99 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds92d
General
CVE-2026-64622 Network-AI (npm https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-64622
Post summary
The post merely names CVE-2026-64622 and links to a vulnerability details page, providing no additional technical, exploit, or mitigation information.
00000123
4.1K followersView on X

Explore more

Back to dashboard