{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "Genkit improper host header validation",
    "tracking": {
      "current_release_date": "2026-08-11T14:40:29Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.0+build.101"
        }
      },
      "id": "VA-26-223-01",
      "initial_release_date": "2026-08-11T14:40:29Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2026-08-11T14:40:29Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "Fixed on 2026-06-18, update to a version released after this date.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "United States",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-223-01.json",
        "summary": "Vulnerability Advisory VA-26-223-01 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "genkit-ai",
        "branches": [
          {
            "category": "product_name",
            "name": "genkit",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<2026-06-18",
                "product": {
                  "name": "genkit-ai genkit <2026-06-18",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "2026-06-18",
                "product": {
                  "name": "genkit-ai genkit 2026-06-18",
                  "product_id": "CSAFPID-0002"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-67179",
      "cwe": {
        "id": "CWE-644",
        "name": "Improper Neutralization of HTTP Headers for Scripting Syntax"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2026-07-28T14:54:11Z/"
        }
      ],
      "title": "Genkit improper host header validation",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ],
        "fixed": [
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/genkit-ai/genkit/issues/5581"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/genkit-ai/genkit/pull/5587"
        },
        {
          "category": "external",
          "summary": "CVE-2026-67179",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67179"
        },
        {
          "category": "external",
          "summary": "VA-26-223-01 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-223-01.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed on or around 2026-06-18.",
          "url": "https://github.com/genkit-ai/genkit/pull/5587",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2026-06-18T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on or around 2026-06-18.",
          "url": "https://github.com/genkit-ai/genkit/pull/5587",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2026-06-18T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "George Chen"
          ]
        }
      ],
      "release_date": "2026-06-18T00:00:00Z"
    }
  ]
}