CVE-2026-109332 — Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Acc…
Published: 2026-10-12 · CVSS: 2.3 · CVSS 4.0
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with a localhost Origin visited by a victim can read unauthenticated endpoints like /health cross-origin.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7