Network‑AI versions prior to 5.15.2 contain a cross‑site WebSocket hijacking flaw in DashboardServer that allows an attacker to read live agent topology. Because the handleUpgrade routine performs no Origin or token validation, a malicious webpage can open a WebSocket to the dashboard’s loopback interface when a user is logged in, granting the attacker access to agent IDs, roles, task descriptions, and token budgets. The weakness is identified as CWE‑1385 and results in a confidentiality breach.

Jovancoding Network‑AI 5.0.0 through 5.15.1 are affected. Any installation of Network‑AI between these releases that includes the unpatched DashboardServer is susceptible. No other vendors or products are listed.

The CVSS score of 5.3 indicates a medium impact risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower exploitation probability at present. The likely attack vector requires a victim to visit a malicious page that establishes a WebSocket to the local dashboard; thus social engineering or phishing is needed to trigger the exploit. If successful, the attacker can exfiltrate sensitive configuration data from the dashboard. Consequently, the overall risk is moderate but warrants timely remediation.