Genkit
Monthly
DNS rebinding and local-network exposure in the Genkit Developer UI server (default port 4000) allows any attacker-controlled website visited by the developer, or any host on the developer's local network, to invoke POST /api/runAction and execute arbitrary registered Genkit actions, reading full results. The root cause is absent Host header validation combined with the server binding to all network interfaces rather than loopback only. No public exploit or CISA KEV listing has been identified; the upstream fix was merged on 2026-06-18 per GitHub PR #5587 and independently corroborated by a CISA CSAF advisory.
DNS rebinding and local-network exposure in the Genkit Developer UI server (default port 4000) allows any attacker-controlled website visited by the developer, or any host on the developer's local network, to invoke POST /api/runAction and execute arbitrary registered Genkit actions, reading full results. The root cause is absent Host header validation combined with the server binding to all network interfaces rather than loopback only. No public exploit or CISA KEV listing has been identified; the upstream fix was merged on 2026-06-18 per GitHub PR #5587 and independently corroborated by a CISA CSAF advisory.