CVE-2026-67179: Genkit improper host header validation
Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Genkit Dev UI serverto a version that resolves this vulnerability.Fixed in 2026-06-18 - Configuration
Upgrade to the fixed state (Fixed on 2026-06-18) to address Genkit improper host header validation in the Dev UI server so requests with untrusted Host headers (e.g., via DNS rebinding) are rejected.
Dev UI server (default port 4000) Host header validation = Enforce proper host request header validation - Compensating control
Restrict network access to the Dev UI server’s default port 4000 (POST /api/runAction) so only authorized clients on the developer’s network can reach it, mitigating DNS rebinding and unauthorized access paths to execute Genkit actions and read results.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67179?
The severity of CVE-2026-67179 is high, rated at 7.8.
How do I fix CVE-2026-67179?
To fix CVE-2026-67179, update Google Genkit to the latest version released after June 2026.
What does CVE-2026-67179 exploit?
CVE-2026-67179 exploits improper validation of host request headers in Google Genkit.
What actions can be executed through CVE-2026-67179?
Through CVE-2026-67179, attackers can execute any registered Genkit action via the Dev UI server.
What impact does CVE-2026-67179 have on data security?
CVE-2026-67179 can lead to unauthorized access to sensitive data as it allows reading results from server actions.