Executive brief
Genkit is a framework for building AI applications that includes a local development server. The dev server binds to all network interfaces without validating request host headers, allowing an attacker on the developer's network or via DNS rebinding to send requests to the Dev UI API and execute arbitrary Genkit actions, potentially exposing sensitive data and compromising the development workflow.
Technical details
This vulnerability is a host header validation bypass in Genkit's local development servers. The Dev UI server (default port 4000) and runtime reflection server bind to all network interfaces (0.0.0.0 / ::) without validating the Host header, allowing unauthenticated requests. An attacker on the developer's network or via DNS rebinding can reach the POST /api/runAction endpoint and execute any registered Genkit action, reading action results and potentially disclosing flow traces and sensitive data. The fix, merged on 2026-06-18, binds the dev servers to loopback interfaces only and implements Host header validation.
Affected products
- Google Genkit prior to fix merged 2026-06-18
Timeline
- 2026-08-11: disclosed
- 2026-06-18: patched