CVE-2026-66005 in Jan
Summary
by MITRE • 07/24/2026
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects arbitrary origins with credentials. Attackers on the local network or using DNS rebinding can reach the unauthenticated OpenAI-compatible API to perform inference, enumerate models, invoke MCP tools, and read cross-origin responses.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability affects the jan software version 0.8.4 and earlier, where a critical cross-origin resource sharing misconfiguration exists in the local API server implementation. The flaw stems from improper handling of trusted host restrictions during server initialization, specifically when processing user-defined configuration parameters. The system replaces legitimate trusted hosts with a wildcard pattern that inadvertently reflects arbitrary origins back to the client, creating an exploitable bypass mechanism.
The technical implementation error occurs at the server-side CORS policy enforcement level where the application fails to properly validate or sanitize the configured trusted origins. When the local API server processes user configurations, it substitutes specific host entries with a generic wildcard character that accepts any origin and includes credentials in the response headers. This design flaw directly violates security principles outlined in the CWE-346 weakness category, which addresses "Trust Boundary Violation" where the system fails to properly distinguish between trusted and untrusted sources.
Network-adjacent attackers can exploit this vulnerability through multiple attack vectors including local network access or DNS rebinding techniques. The impact extends beyond simple data exfiltration to full API compromise, enabling unauthorized users to perform inference requests against the OpenAI-compatible API endpoint without authentication. Additionally, attackers can enumerate available models through the API, invoke model control protocol tools, and read cross-origin responses that would normally be restricted. This comprehensive access represents a critical security breach affecting the application's integrity and confidentiality.
The operational implications are severe as this vulnerability allows complete unauthorized access to the local AI inference capabilities and associated tooling. The attack surface includes not only the core API functionality but also any MCP (Model Control Protocol) tools that may be exposed through the same endpoint. This creates a persistent threat vector where local network adversaries can leverage the system's legitimate API access for malicious purposes, potentially leading to data leakage or service disruption.
Mitigation strategies should focus on implementing proper CORS policy enforcement with explicit host validation rather than wildcard substitution. The fix requires replacing the problematic configuration handling logic with secure validation mechanisms that properly sanitize and verify trusted origins before applying them to the CORS policy. Organizations should also implement network segmentation controls and consider additional authentication layers for local API endpoints to reduce the attack surface. This vulnerability demonstrates the critical importance of proper input validation in security-critical components, as highlighted by ATT&CK technique T1071.004 for Application Layer Protocol: DNS, where improper trust boundary enforcement can lead to unauthorized access through seemingly legitimate network paths.