Remote Code Execution in OpenYak Desktop due to Inadequate API Security
CVE-2026-46409

9.6CRITICAL

Key Information:

Vendor

Openyak

Status
Openyak
Vendor
CVE Published:
7 August 2026

What is CVE-2026-46409?

OpenYak Desktop versions prior to 1.1.3 are vulnerable due to an HTTP API that is bound to a loopback address without adequate security measures. This weakness allows any web page visited by a user to issue cross-origin requests to the local server. By exploiting this vulnerability, an attacker can execute arbitrary shell commands, exfiltrate sensitive user data including chat history and personally identifiable information (PII), and control the OpenYak service without requiring any user interaction beyond visiting a malicious webpage. The issue has been addressed in version 1.1.3, which implements necessary security enhancements.

Affected Version(s)

openyak < 1.1.3

References

https://github.com/openyak/openyak/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.