CVE-2026-67179

Genkit’s Dev UI server (default port 4000) suffers from improper validation of host request headers, enabling DNS rebinding to reach POST /api/runAction from any host on the developer’s network or any site the developer visits. This allows an attacker to execute any registered Genkit action and r...

PT-2026-70265

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...