CVE-2026-46409 Overview
CVE-2026-46409 affects OpenYak, a local-first agent runtime for tool-using language models. The OpenYak desktop backend binds an HTTP API to 127.0.0.1 on a random port (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement. The service also applies a wildcard CORS policy. Any webpage a user visits while OpenYak runs can issue cross-origin requests to the local server, using the browser as a proxy into loopback. Chained together, these flaws allow a malicious page to execute arbitrary shell commands, terminate the service, and exfiltrate chat history and account PII. Version 1.1.3 patches the issue.
Critical Impact
A single visit to a malicious page can trigger remote code execution on the host through the OpenYak build agent when permission_presets.bash=true, with no user interaction beyond opening the page.
Affected Products
- OpenYak desktop runtime prior to version 1.1.3
- OpenYak build agent configurations with permission_presets.bash=true
- Systems running the OpenYak local HTTP API on loopback (commonly port 19141)
Discovery Timeline
- 2026-08-07 - CVE-2026-46409 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-46409
Vulnerability Analysis
The OpenYak desktop backend exposes an HTTP API bound to the loopback interface. The API omits three controls that normally protect local services from web-origin attacks: Origin header validation, authentication on loopback requests, and Content-Type enforcement. A wildcard CORS policy compounds these gaps by explicitly permitting any web origin to interact with the API.
Browsers treat loopback as reachable from any page. When a user browses a malicious site, that page can send fetch or XMLHttpRequest calls to http://127.0.0.1:19141 and receive responses. The OpenYak API accepts these requests as if they originated from the local desktop client. This category of flaw maps to CWE-94: Improper Control of Generation of Code, because the request path terminates in command execution through the build agent.
An attacker chains the CORS and authentication gaps with the build agent's bash permission preset to run arbitrary shell commands. The same channel exposes chat history and account PII, and allows the attacker to shut the service down to hinder incident response.
Root Cause
The root cause is the assumption that binding to 127.0.0.1 is sufficient isolation. Loopback binding blocks external network peers but does not block browser-mediated cross-origin requests. Without Origin checks, loopback authentication tokens, or preflight-triggering Content-Type restrictions, the API trusts every caller reaching the socket.
Attack Vector
Exploitation requires the victim to visit a malicious or compromised web page while OpenYak is running. The page issues cross-origin requests to the loopback API, invokes the build agent's bash execution endpoint, and receives responses under the wildcard CORS policy. Full technical details are available in the OpenYak GitHub Security Advisory GHSA-ccxp-q2w5-27jw.
Detection Methods for CVE-2026-46409
Indicators of Compromise
- Unexpected child processes spawned by the OpenYak desktop process or its build agent, particularly shells such as bash, sh, cmd.exe, or powershell.exe.
- Outbound network connections from processes launched by OpenYak to unfamiliar domains shortly after browser activity.
- OpenYak service terminations that correlate with recent web browsing sessions.
Detection Strategies
- Monitor for HTTP requests to 127.0.0.1:19141 (or other OpenYak loopback ports) with Origin headers pointing to arbitrary external websites.
- Alert on process lineage where a browser tab or renderer precedes shell execution under the OpenYak agent within a short window.
- Inspect endpoint telemetry for OpenYak build agent invocations that include arbitrary command strings not issued by the local desktop UI.
Monitoring Recommendations
- Enable command-line logging on endpoints running OpenYak to capture arguments passed to spawned shells.
- Track OpenYak version inventory and flag hosts running versions prior to 1.1.3.
- Review DNS and proxy logs for browser sessions immediately preceding suspicious local process activity.
How to Mitigate CVE-2026-46409
Immediate Actions Required
- Upgrade OpenYak to version 1.1.3 or later on every host where the desktop workspace is installed.
- Disable the build agent's permission_presets.bash=true setting until the upgrade is confirmed.
- Terminate the OpenYak backend process on any endpoint that cannot be updated immediately.
Patch Information
OpenYak version 1.1.3 fixes CVE-2026-46409 by addressing the loopback API's missing controls. Refer to the OpenYak GitHub Security Advisory GHSA-ccxp-q2w5-27jw for the release notes and remediation guidance.
Workarounds
- Restrict browser use on hosts running unpatched OpenYak versions, or run OpenYak inside an isolated user profile that does not browse the web.
- Block outbound access from the OpenYak process to non-approved destinations using a host firewall.
- Remove the bash permission preset from the build agent configuration to eliminate the command execution path until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
