CVE-2026-66005

Katalog CVE

CVSS 6.3 · Medium EPSS 0,33%

Kerentanan Permissive List of Allowed Inputs. Skor CVSS 3.1 6.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects arbitrary origins with credentials. Attackers on the local network or using DNS rebinding can reach the unauthenticated OpenAI-compatible API to perform inference, enumerate models, invoke MCP tools, and read cross-origin responses.

Rincian

Terbit di NVD

24 Juli 2026

Terakhir diubah

17 September 2026

Status NVD

Deferred

CVSS 3.1

6.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-183: Permissive List of Allowed Inputs
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/janhq/jan/commit/3e1c1e724f696620d89bb4a9cc18a380e0753757
• https://github.com/janhq/jan/issues/8453
• https://github.com/janhq/jan/pull/8506
• https://www.vulncheck.com/advisories/jan-local-api-server-cors-origin-reflection-via-binding