CVE-2026-67179
Received Received - Intake

Genkit Dev UI Server Host Header Validation Bypass

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description
Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-67179
EUVD
EUVD-2026-56240

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
genkit genkit to 2026-06-18 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-644 The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Genkit's local development servers improperly validate host request headers and bind to all network interfaces instead of just localhost. This allows any host on the developer's network or via DNS rebinding attacks to send requests to the Dev UI server. Attackers can execute arbitrary registered actions and read their results, including sensitive data like model prompts and user secrets.

Detection Guidance

Check if Genkit's Dev UI server (default port 4000) is binding to all network interfaces (0.0.0.0) instead of localhost (127.0.0.1). Use commands like 'netstat -tulnp | grep 4000' or 'ss -tulnp | grep 4000' to verify the listening address. Also inspect network traffic for unexpected POST requests to /api/runAction from external sources.

Impact Analysis

An attacker on your network or via a malicious website could access your Genkit Dev UI server (default port 4000) and run any registered action. They could steal sensitive data like inputs, outputs, prompts, or secrets. The telemetry server's trace endpoint also exposes flow traces with sensitive information due to a wildcard CORS policy.

Compliance Impact

This vulnerability could lead to unauthorized access and exfiltration of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Unauthorized code execution may also breach compliance with data integrity and access control mandates.

Mitigation Strategies

Update Genkit to the fixed version released on 2026-06-18. Ensure the Dev UI server binds only to localhost by setting GENKIT_DEV_SERVER_HOST=127.0.0.1. Disable wildcard CORS on the telemetry server's trace endpoint and validate Host headers to prevent DNS rebinding attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67179. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart