Skip to content

Hide Navigation Hide TOC

Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj) - ATR-2026-01981 (e7364ff7-afda-5fbe-9218-194260fbb8d9)

Detects GHSA-mxjx-28vx-xjjj (CWE-862 Missing Authorization + CWE-352 CSRF via wildcard CORS): network-ai's ApprovalInbox HTTP server (lib/approval-inbox.ts) has no authentication of any kind and sets Access-Control-Allow-Origin: * on every route, including the state-changing POST /approvals/:id/approve and /deny. ApprovalInbox is the network surface of the human-in-the-loop Approval Gate that gates high-risk operations (writes, shell commands, budget spend). Any caller that can reach the inbox port — a co-located process, an SSRF, a non-loopback remote client, or any website the operator visits in a browser via the wildcard CORS — can enumerate pending approvals (GET /approvals/) and approve them (POST /approvals/:id/approve) with no Authorization header, defeating the Approval Gate so a gated shell command executes without consent. Affected: network-ai <= 5.11.0. Detection covers: (a) a state-changing request to the approval control plane (/approvals//approve or /deny) with no auth context, matching the unauthenticated-client PoC shape; (b) an enumeration request to the approval queue (GET /approvals/) paired with the wildcard-CORS marker on the approval control plane; (c) explicit GHSA-mxjx-28vx-xjjj / ApprovalInbox exploitation framing. The detection target is the request shape at the approval control plane — an unauthenticated approve/deny or enumerate call combined with the wildcard-CORS marker — which is the exact bypass primitive, caught before the gated action is released.

Cluster A Galaxy A Cluster B Galaxy B Level
Exploitation for Privilege Escalation - T1068 (b21c3b2d-02e6-45b1-980b-e69051040839) Attack Pattern Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj) - ATR-2026-01981 (e7364ff7-afda-5fbe-9218-194260fbb8d9) Agent Threat Rules 1
Exploit Public-Facing Application (47d73872-5336-44f7-81e3-d30bc7e039dd) MITRE ATLAS Attack Pattern Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj) - ATR-2026-01981 (e7364ff7-afda-5fbe-9218-194260fbb8d9) Agent Threat Rules 1
Exploit Public-Facing Application - T1190 (3f886f2a-874f-4333-b794-aa6075009b1c) Attack Pattern Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj) - ATR-2026-01981 (e7364ff7-afda-5fbe-9218-194260fbb8d9) Agent Threat Rules 1