Tools AI Risk Radar ai-incident-0218
Incident record
Network-AI fixes a bypass of denied tool targets
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- Network-AI 5.14.0 through 5.15.1
- Actor
- researcher
- CVE
- CVE-2026-109331
What happened
The permission bridge checked the first candidate field instead of every applicable target, allowing a denied target to pass the check under the reported conditions.
The maintainer published its advisory on 27 September and identifies version 5.15.2 as fixed. Its CVSS 3.1 score is 8.4 High. The later CNA record uses different ratings; the severity here follows the maintainer.
Sources
- Original advisory or disclosuregithub.com/Jovancoding/Network-AI/security/advisories/GHSA-9…
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-109331
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026