Network-AI MCP SSE Server Default-Empty-Secret Authentication Bypass with Wildcard CORS
First seen Jul 20, 2026 · Updated Jul 20, 2026 · CVSS 7.6
Network-AI's MCP SSE server ships with an empty default authentication secret, meaning every request is treated as authorized regardless of whether an Authorization header is present. Combined with a wildcard CORS policy on all responses, this lets a malicious webpage silently invoke any of the 22 exposed MCP tools on a victim's local server, including spawning agents and writing to shared blackboard state. This is a classic drive-by CSRF-style attack against a locally running privileged agent orchestrator.
Technical Analysis
The root cause is a fallback expression (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''`) that defaults to an empty string when the environment variable is unset, and the authorization check `_isAuthorized` treats this as always-valid, so no credential is actually required. The server further sets `Access-Control-Allow-Origin: *` on every response, removing the same-origin protections that would normally stop a browser from letting arbitrary websites read cross-origin responses. An attacker only needs to lure a victim (who has the default-configured MCP server running locally) to a malicious webpage; client-side JavaScript can then issue fetch requests directly to the local MCP endpoint and invoke privileged tools such as `config_set`, `agent_spawn`, and `blackboard_write` with no authentication and full response visibility. This crosses the browser/localhost trust boundary and the human-interface-to-agent boundary, turning passive web browsing into a vector for full agent-orchestration compromise.
Affected Systems
Network-AI; protocols: MCP
Detection Signatures
- Requests to MCP SSE endpoint lacking Authorization header that still succeed (HTTP 200)
- Response headers containing 'Access-Control-Allow-Origin: *' on MCP tool endpoints
- Unexpected calls to agent_spawn, config_set, or blackboard_write originating from browser-referrer traffic
- NETWORK_AI_MCP_SECRET environment variable unset or empty in deployment configs
- Cross-origin fetch/XHR traffic to localhost MCP ports (default Network-AI MCP port) from unrelated domains
Remediation Steps
- 1
Upgrade Network-AI
Update to version 5.4.5 or later, which fixes the default-secret and CORS issues.
- 2
Set a strong MCP secret
Explicitly configure NETWORK_AI_MCP_SECRET to a strong, unique random value; never rely on the default/empty fallback.
- 3
Restrict CORS policy
Configure the MCP server to allow only trusted, explicitly-listed origins instead of a wildcard Access-Control-Allow-Origin.
- 4
Bind to localhost with network controls
Ensure the MCP server is not reachable from untrusted networks and add same-origin/CSRF protections (e.g., SameSite cookies, custom header checks) in addition to bearer tokens.
- 5
Audit tool exposure
Review which of the 22 exposed MCP tools truly need to be network-accessible and apply least-privilege scoping/authorization per tool.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.