CVE-2026-67179: Genkit RCE Vulnerability

CVE-2026-67179 Overview

CVE-2026-67179 affects Genkit, an open-source generative AI framework, where the Developer UI server fails to validate incoming host request headers. The Dev UI server listens on the default port 4000 and exposes a POST /api/runAction endpoint. Any host on the developer's local network, and any website visited by the developer through DNS rebinding, can reach this endpoint and execute registered Genkit actions. Attackers can then read the responses returned by those actions. The flaw is classified under CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax. A fix was published on 2026-06-18.

Critical Impact
Remote websites can execute arbitrary registered Genkit actions on a developer's workstation via DNS rebinding, exposing AI model outputs, credentials, and downstream integrations.

Affected Products

Genkit AI framework (Dev UI server component)
Deployments exposing the Dev UI on default port 4000
Developer workstations running Genkit prior to the 2026-06-18 fix

Discovery Timeline

2026-06-18 - Fix committed to the Genkit repository
2026-08-11 - CVE-2026-67179 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-67179

Vulnerability Analysis

Genkit ships a Developer UI that binds locally to port 4000 and exposes an HTTP API for running any registered Genkit action. The server does not validate the Host header of incoming requests. As a result, the server accepts requests that carry arbitrary host values, including public domain names controlled by an attacker. This is the canonical precondition for a DNS rebinding attack against a locally bound service.

The POST /api/runAction route is the primary attack surface. It accepts an action identifier and input parameters, dispatches the action to the Genkit runtime, and returns the result to the caller. Registered actions typically wrap model calls, tool invocations, and application-specific logic, so successful invocation exposes model outputs, tool responses, and any data those actions can reach.

Root Cause

The root cause is missing host header validation on the Dev UI HTTP server, tracked as [CWE-644]. Without an allowlist restricting requests to localhost or 127.0.0.1, the server treats any origin as trusted once TCP reaches the listening socket.

Attack Vector

An attacker registers a domain that resolves initially to a controlled IP and later rebinds to 127.0.0.1. When a developer visits the attacker's site, JavaScript in the page waits for the DNS TTL to expire, then issues a POST to /api/runAction against the rebinding hostname. Because the browser now sends the request to the local Genkit Dev UI while treating it as same-origin, the script can invoke actions and read the responses. Any host on the same LAN as the developer can also reach the endpoint directly without rebinding.

The vulnerability is described in the GitHub issue report and remediated in the associated GitHub pull request.

Detection Methods for CVE-2026-67179

Indicators of Compromise

Inbound HTTP requests to port 4000 on developer workstations from non-loopback addresses.
POST /api/runAction requests carrying a Host header that is not localhost or 127.0.0.1.
Unexpected invocation of registered Genkit actions outside active developer sessions.

Detection Strategies

Instrument the Dev UI HTTP server to log the Host, Origin, and Referer headers of every request and alert on non-loopback values.
Monitor outbound DNS resolutions on developer endpoints for domains with unusually short TTLs that resolve to both public and private IP ranges.
Baseline normal action-execution telemetry inside Genkit and flag deviations in action invocation frequency or source.

Monitoring Recommendations

Capture endpoint network telemetry for connections targeting local ports commonly used by developer tooling, including 4000.
Correlate browser process activity with local HTTP server access to identify rebinding-style patterns.
Ingest developer workstation logs into a centralized data lake for retrospective hunting across the fleet.

How to Mitigate CVE-2026-67179

Immediate Actions Required

Upgrade Genkit to a version that contains the 2026-06-18 fix delivered in pull request #5587.
Restrict the Dev UI listener to 127.0.0.1 and never bind it to 0.0.0.0 on shared networks.
Terminate any running Dev UI instances on developer machines that are not actively in use.

Patch Information

The maintainers merged the host header validation fix into the Genkit repository on 2026-06-18. Refer to the CVE record for CVE-2026-67179 and the CSAF advisory for the authoritative fixed-version metadata.

Workarounds

Run the Dev UI only behind a local firewall rule that blocks inbound traffic to port 4000 from non-loopback sources.
Use a browser profile dedicated to Genkit development that does not visit untrusted websites while the Dev UI is running.
Configure host operating system DNS resolvers to reject responses that map public domains to private IP ranges, mitigating DNS rebinding.

bash

# Example: block inbound traffic to Genkit Dev UI on Linux (iptables)
iptables -A INPUT -p tcp --dport 4000 ! -i lo -j DROP

# Example: bind Dev UI to loopback only when launching Genkit
export GENKIT_UI_HOST=127.0.0.1
export GENKIT_UI_PORT=4000