medium4.3
CVE-2026-109330
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topol…
Impact
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.
Affected products
| Product | Affected versions |
|---|---|
| Network-AI 5.0.0 | before 5.15.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.