{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0420",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "n4d mesh uses exposed AI services and MCP command loops",
  "details": "## What\n\nThe n4d mesh campaign used Shodan-driven discovery across ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio, and MCP infrastructure. The reported chain included MCP JSON-RPC execute_command loops and harvesting of cloud, Kubernetes, Bedrock, and GPT-4 credentials. Victim counts were not published.\n\n## Which configuration is exposed\n\nThe exposed configuration combines a non-loopback AI service with a reachable MCP server whose host is not loopback. The product surface may vary, so the matcher uses a named exposure feature and scopes the remote-host check to one MCP server element rather than combining fields from different servers.\n\n## How ACVE detects it\n\nACVE checks ai.surface.exposed and a remote-looking mcpServers.urlHost. It does not probe Shodan, execute JSON-RPC, or infer whether the remote service is actually public. Missing host data is possible.\n\n## Fix\n\nBind AI services to private interfaces, add authentication and network allowlists, disable execute_command-style tools, and rotate cloud, Kubernetes, Bedrock, and model-provider credentials after investigation. Review Docker and Redis exposure as part of containment.\n\n## Grounding needed\n\nThe public page should be checked against the underlying XLab source for campaign dates and impact. The actor claim is retained, but no victim count is invented.\n\nThis record is limited to the condition named in the public source: n4d mesh uses exposed AI services and MCP command loops. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "ai-infrastructure"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "exposed-surface",
        "credential-theft",
        "command-injection"
      ],
      "cwe": [
        "CWE-522"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://cybersecuritynews.com/nadmesh-uses-shodan/",
            "type": "dfir"
          }
        ],
        "kev": {
          "listed": false
        },
        "victims": {
          "range": "unverifiable",
          "sectors": [
            "technology"
          ],
          "evidence": "The cited XLab-linked coverage describes harvesting and resale targets but publishes no victim count."
        },
        "attribution": "n4d mesh controller"
      },
      "cveBoundary": "exposed-surface",
      "matcher": {
        "all": [
          {
            "field": "features[\"ai.surface.exposed\"]",
            "op": "eq",
            "value": true
          },
          {
            "some": "mcpServers",
            "where": {
              "field": "urlHost",
              "op": "regex",
              "value": "^(?!localhost$|127\\.0\\.0\\.1$|::1$).+"
            }
          }
        ]
      },
      "fix": {
        "summary": "Remove public AI service exposure and disable untrusted MCP command tools.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "features[\"ai.surface.exposed\"]",
            "to": "false",
            "why": "Close the public service boundary."
          },
          {
            "type": "reconfigure",
            "target": "mcpServers",
            "why": "Remove execute_command loops and require authentication."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:17:48Z",
          "sources": [
            {
              "url": "https://cybersecuritynews.com/nadmesh-uses-shodan/",
              "status": 200,
              "contentType": "text/html; charset=UTF-8",
              "sha256": "sha256:c5a7e33b160efe0f9990b2241e15defc5234e3fc2654ee08d951b03487d833af",
              "type": "dfir"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}