# CORS Private Network Access Misconfiguration

> Detects CORS configurations that allow access from public origins to private network endpoints.

- Skill: `zakirkun/cors-private-network-access-misconfiguration` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/cors-private-network-access-misconfiguration`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/cors-private-network-access-misconfiguration/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/cors-private-network-access-misconfiguration

---


# CORS Private Network Access Misconfiguration

## Overview
Chrome's Private Network Access (PNA) restrictions protect internal services. However, misconfigured CORS headers (`Access-Control-Allow-Private-Network: true` without origin restriction) allow malicious public websites to make requests to internal APIs running on private IP ranges. This enables CSRF attacks against private services.

## Remediation
- Only allow specific trusted origins for private network access
- Implement authentication on all internal APIs
- Do not set `Access-Control-Allow-Private-Network: true` for wildcard origins