Description
Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| genkit-ai | genkit | < 2026-06-18 | 2026-06-18 |
Advisories 1
- VA-26-223-01 Genkit improper host header validation CISA ICS & IT advisories · Aug 11, 2026