# CVE-2026-120314: Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Jovancoding / Network-AI (network-ai): ≥ 5.14.0; < 5.15.5 (affected, semver); 5.15.5 (unaffected, semver). Source: CNA: VulnCheck

## Severity and prioritization

- CVSS 4.0: 6.9 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N; source: CNA: VulnCheck

- CVSS 3.1: 7.3 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L; source: CNA: VulnCheck

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-306

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qvf5-9prv-7r9c (CNA: VulnCheck; vendor-advisory)

- https://www.vulncheck.com/advisories/network-ai-5.14.0-before-5.15.5-missing-authentication-in-a2aserver-task-operations (CNA: VulnCheck; third-party-advisory)

## Provenance

- CNA: VulnCheck: https://www.cve.org/CVERecord?id=CVE-2026-120314; retrieved 2026-11-02; source updated 2026-11-02

Revision: 0f976e18b9342e342dc998c90bd3786c58b5b04238740fd9f2111903bef58713

Canonical: https://y2.dev/cve/CVE-2026-120314