CVE-2026-46409 OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution
A malicious webpage can exploit missing CSRF protections in OpenYak's local API to execute arbitrary shell commands and steal data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-46409?
CVE-2026-46409 is a critical vulnerability in openyak, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage a user visits while OpenYak is running can issue cross-origin requests to this local server — the browser acts as a proxy into loopback, bypassing OS-level network isolation. Chained, this lets a malicious page execute arbitrary shell commands on the host (RCE) via the build agent with `permission_presets.bash=true`, shut down the service, and exfiltrate chat history and account PII — with no user interaction beyond opening the page. Version 1.1.3 patches the issue.
Which versions are affected by CVE-2026-46409?
How do I fix CVE-2026-46409?
No fix has been published for CVE-2026-46409 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-46409 being exploited?
There is no known exploitation of CVE-2026-46409 in the wild and no public exploit code.
Sources
Also known as CVE-2026-51386, GHSA-ccxp-q2w5-27jw.