Live › vulnerability › CVE-2026-120314
Network-AI versions 5.14.0 before 5.15.5 have an A2AServer class that skips authentication when no secret is configured. An unauthenticated attacker can send JSON-RPC requests to tasks/send, tasks/get and tasks/cancel to run tasks, read their results and cancel them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 03:31 UTC. All times on this page are UTC.
Teams running Network-AI 5.14.0 up to but not including 5.15.5 that expose the A2AServer class. Exposure depends on whether a secret is configured; without one, any caller that can reach the endpoint can access task operations. Deployments that do not use A2AServer or that require a Bearer token are less exposed.
No product ranges from the sources yet.
5.15.5.5.15.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.
This page as .md · .json · in your agent: get_signal("CVE-2026-120314")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.