AIKIDO-2026-741744
@genkit-ai/core is vulnerable to Improper Access Control
56
Medium Risk
This Affects:
@genkit-ai/coreTL;DR
The Genkit runtime reflection server exposes an unauthenticated HTTP endpoint that can execute registered actions and return flow execution data. It calls listen without a host argument, so it binds to all network interfaces when an application runs in development mode. Any host that can reach the port can invoke actions and read execution traces without authentication. The fix binds the reflection server to the loopback interface by default and adds an environment variable to opt into exposing it on other interfaces.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run an application in Genkit development mode (GENKIT_ENV=dev) that starts the runtime reflection server.
Background info
@genkit-ai/core is vulnerable to Improper Access Control in versions 0.5.0 - 1.39.0.
How to fix this
Upgrade the @genkit-ai/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant