openyak vulnerabilities

Products

• openyak 1

Latest openyak CVEs

Newest publication first

1. CVE-2026-46409 OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

   Published 2026-08-07

   Critical·CVSS 9.6 EPSS 0.28%

   OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1:<random port> (commonly 19141) without server-side Origin validation, loopback authenti...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.