urlissue tracking
https://github.com/genkit-ai/genkit/issues/5581 CVE-2026-67179
HIGH
Genkit improper host header validation
Record summary
CVE-2026-67179 has a selected CVSS score of 7.8 (high).
Description
Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18.
Description source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unknown | CVE List | Before 2026-06-18 | affected |
| 2026-06-18 | unaffected |
References
5urlpatch
https://github.com/genkit-ai/genkit/pull/5587 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-67179 urlThird-party advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-223-01.json urlvdb entry
https://www.cve.org/CVERecord?id=CVE-2026-67179