AIKIDO-2026-266755
genkit is vulnerable to Improper Access Control
62
Medium Risk
This Affects:
genkitTL;DR
The Genkit runtime started by the genkit library exposes a reflection server that lists registered actions and executes them through a runAction endpoint without authentication. This server binds to all network interfaces by default, so any host that can reach the developer machine can enumerate and invoke registered flows and actions while a development server is running. This enables unauthorized action execution and disclosure of action schemas over the network. The fix binds the reflection server to 127.0.0.1 by default and adds a host option and environment variable to opt into other interfaces.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run a Genkit development server reachable from an untrusted network.
Background info
genkit is vulnerable to Improper Access Control in versions 0.9.0 - 1.39.0.
How to fix this
Upgrade the genkit library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant