CVE-2026-67179

Name of the Vulnerable Software and Affected Versions Genkit (affected versions not specified)

Description Insufficient validation of host request headers allows any host on the developer's network or any website visited by the developer via DNS rebinding (a technique used to bypass the Same-Origin Policy) to access the Dev UI server on the default port 4000. This enables an attacker to reach the 'POST /api/runAction' endpoint, execute any registered Genkit action, and read the resulting output.

Recommendations Update to the version released on 2026-06-18.