CVE-2026-120314 Jovancoding CVE debrief

Who should care

Defenders responsible for Network-AI deployments should assess exposure and verify the configuration of the A2AServer class. They should also ensure that secrets are properly set to prevent unauthenticated access to task operations. Additionally, defenders should review compensating controls for exposed systems and monitor for suspicious activity. Security teams and vulnerability management teams should also be aware of the potential impacts of this vulner

Why it matters

CVE-2026-120314 is a missing authentication vulnerability in Network-AI's A2AServer class, affecting versions 5.14.0 before 5.15.5. Defenders should verify the configuration of Network-AI's A2AServer class and ensure that secrets are properly set to prevent unauthenticated access to task operations.

• Unauthenticated access to task operations
• Potential for task execution, result reading, and task cancellation
• Verification of secret configuration required

Technical summary

The vulnerability is caused by a missing authentication mechanism in the A2AServer class of Network-AI versions 5.14.0 before 5.15.5. This allows unauthenticated attackers to access task operations when no secret is configured. The vulnerability affects Network-AI deployments that have not configured secrets for the A2AServer class. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks. Defenders should prioritize verifying the configuration of Network-AI's A2AServer class and ensuring that secrets are properly set.

Defensive priority

Defenders should prioritize verifying the configuration of Network-AI's A2AServer class and ensuring that secrets are properly set.

Recommended defensive actions

• Verify the configuration of Network-AI's A2AServer class to ensure secrets are properly set.
• Restrict access to task operations to authenticated users only.
• Monitor for suspicious JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD records. However, details about the vendor's response, affected versions, and exploitation are limited. Defenders should verify the configuration of Network-AI's A2AServer class and ensure that secrets are properly set to prevent unauthenticated access to task operations. The CVE Program and NVD records provide official confirmation of the vulnerability. However, further details about the vendor's response and affected versions are limited. Network-AI deployments should be aud

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.