Genkit fails to correctly validate host request headers, allowing any host on the developer’s network or any site the developer visits through DNS rebinding to post to the Dev UI server’s /api/runAction endpoint on the default port 4000. This enables the attacker to invoke any registered Genkit action and obtain its result, effectively providing arbitrary code execution on the development environment. The flaw is a classic case of improper host header validation (CWE‑644) and poses a high severity risk if the development server is reachable over a network. Based on the supplied description, the attacker can gain non‑authentic access to execute actions and read outputs, leading to potential compromise of development data and resources.

The affected product is Genkit (genkit‑ai:genkit). No specific version range is listed in the vulnerability data, but the fix was merged on 2026‑06‑18, so all pre‑2026‑06‑18 releases are vulnerable and should be regarded as affected until otherwise noted.

The CVSS score of 7.8 classifies the issue as high severity, yet the EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog. Because the attacker must target the HTTP host header, the attack vector is primarily network‑based and usually requires the development server to be listening on an accessible port (default 4000). If the Dev UI is restricted to local access only, the risk is confined to the host machine; if exposed to a broader network or the internet, the potential for exploitation increases significantly. In short, while the technical risk is high, the practical exploitation probability remains low under typical deployment scenarios.