---
id: CVE-2026-46409
title: >-
  OpenYak is a local-first agent runtime for reliable tool-using models, with a
  desktop workspace built on top
summary: >-
  OpenYak is a local-first agent runtime for reliable tool-using models, with a
  desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop
  backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141)
  without ser…
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'
cwe:
  - CWE-94
  - CWE-306
  - CWE-346
  - CWE-352
  - CWE-942
published: '2026-08-07'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46409'
references:
  - url: 'https://github.com/openyak/openyak/security/advisories/GHSA-ccxp-q2w5-27jw'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00282
epssPercentile: 0.18374
ingestedAt: '2026-09-18T20:51:25.597Z'
---

## Overview

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage a user visits while OpenYak is running can issue cross-origin requests to this local server — the browser acts as a proxy into loopback, bypassing OS-level network isolation. Chained, this lets a malicious page execute arbitrary shell commands on the host (RCE) via the build agent with `permission_presets.bash=true`, shut down the service, and exfiltrate chat history and account PII — with no user interaction beyond opening the page. Version 1.1.3 patches the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.