CVE-2026-120314

{
  "etk_id": "ETK-2026-3262",
  "cve_id": "CVE-2026-120314",
  "display_id": "CVE-2026-120314",
  "ghsa_id": "GHSA-vw9p-p26h-v56v",
  "euvd_id": "EUVD-2026-115003",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authentication in Network-AI A2AServer",
  "summary": "Network-AI versions 5.14.0 through versions before 5.15.5 can expose A2AServer task operations without authentication. An unauthenticated attacker may submit work, view task results, or cancel tasks when no server secret is configured.",
  "mitigation": "Upgrade Network-AI to version 5.15.5 or later. Configure an A2AServer secret and restrict access to the service until the update is deployed.",
  "vendor": "Jovancoding",
  "product": "Network-AI",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.14.0, < 5.15.5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.15.5"
      ],
      "package_name": "Network-AI",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 10.710581366666666,
  "t0_at": "2026-11-02T02:01:12.990000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-02T04:23:34.083236+00:00",
      "days": 0.09885524578703704,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T02:01:12.990000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-02T02:01:12.990000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T02:01:12.990000+00:00",
      "url": "https://github.com/advisories/GHSA-vw9p-p26h-v56v"
    }
  }
}