Skip to content
OpenAdvisories

Vendor

openyak

1 known vulnerabilities.

Products

openyak 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.6
    CVE-2026-46409

    OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

    OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin valida…

    openyak openyak