CVE-2026-46409

Received Received - Intake

Remote Code Execution in OpenYak Desktop Backend

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage a user visits while OpenYak is running can issue cross-origin requests to this local server — the browser acts as a proxy into loopback, bypassing OS-level network isolation. Chained, this lets a malicious page execute arbitrary shell commands on the host (RCE) via the build agent with `permission_presets.bash=true`, shut down the service, and exfiltrate chat history and account PII — with no user interaction beyond opening the page. Version 1.1.3 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-46409

Affected Vendors & Products

Vendor	Product	Version / Range
openyak	openyak	to 1.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

OpenYak before version 1.1.3 exposes an HTTP API on localhost without proper security controls. It lacks Origin validation, authentication, and Content-Type enforcement, and uses a wildcard CORS policy. This allows any webpage a user visits to send requests to the local server, acting as a proxy into the system.

Detection Guidance

Check if OpenYak is running and listening on a local port (commonly 19141) using commands like 'netstat -tuln | grep 19141' or 'ss -tuln | grep 19141'. If OpenYak is running and the port is open, the system may be vulnerable.

Impact Analysis

A malicious webpage could exploit this to execute arbitrary shell commands on your computer (RCE), shut down OpenYak, or steal sensitive data like chat history and account PII. The attacker only needs you to visit the malicious page while OpenYak is running.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access control. It may result in data breaches, triggering compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade OpenYak to version 1.1.3 or later immediately. If upgrading is not possible, disable the OpenYak desktop backend or block external access to the local port using firewall rules until the update is applied.

Hi! I’m here to help you understand CVE-2026-46409. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70