Unauthenticated CSRF chain leading to RCE in OpenYak desktop backend (CVE-2026-46409)

The OpenYak desktop backend exposes a local HTTP API on 127.0.0.1 without Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage visited while OpenYak is running can issue cross-origin requests to this API, enabling a malicious page to execute arbitrary shell commands on the host (RCE) via the build agent, shut down the service, and exfiltrate chat history and account PII with no user interaction beyond opening the page. Affected versions: - <= 1.1.2 We recommend updating to: 1.1.3. CVSS 9.6 · our assessment: act_now Reference: https://github.com/openyak/openyak/security/advisories/GHSA-ccxp-q2w5-27jw Details: https://vuln.today/cve/CVE-2026-46409