CVE-2026-66005: CORS misconfig exposes local LLM

CISO Take

Jan's local API server ships with a broken CORS trusted-host check: instead of enforcing the user-configured allowlist, it silently swaps in a wildcard that reflects any requesting origin while still allowing credentials, which defeats the browser's same-origin protections entirely. A CISO should care because this turns 'it only listens locally' into a false assumption — any attacker on the same network segment, or a malicious website using DNS rebinding, can drive a victim's browser to reach the unauthenticated OpenAI-compatible endpoint and run inference, enumerate loaded models, and invoke connected MCP tools, then read the cross-origin responses. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this isn't under active mass exploitation, but the bug requires no credentials and only one instance of user interaction (visiting a page while Jan is running) to trigger — a low bar for a targeted attack against a developer or power user running local AI tooling. Upgrade to the version built from commit 3e1c1e7 (post-0.8.4) immediately; until then, don't run Jan's API server while browsing untrusted sites, bind it to loopback only and firewall off LAN access, and audit any MCP tool logs for unexpected cross-origin invocations.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

Medium overall (CVSS 6.3) but the exploitability profile is more concerning than the base score suggests for AI-specific deployments: attack vector is network, complexity is low, and no privileges are required — the only gate is user interaction (visiting an attacker page or being subject to DNS rebinding) while Jan is running. There is no evidence of active exploitation (not in CISA KEV, no EPSS score published, no public exploit code, no Nuclei template), which keeps urgency at 'patch on next cycle' rather than 'patch now,' but the confidentiality/integrity/availability impact (each rated low individually) understates the practical risk when the exposed surface includes MCP tool invocation, since tools can have side effects (file access, network calls, code execution) well beyond simple data disclosure. Exposure is highest for developers and power users who run Jan as a persistent local service while also browsing the open internet.

How does the attack unfold?

Reconnaissance

Attacker identifies a target running Jan's local API server, either by scanning the local network or by luring the victim to a page that will attempt DNS rebinding against the local server's port.

AML.T0006

CORS bypass

The victim's browser sends a cross-origin request to Jan's API; the server's trusted-host check is replaced by a wildcard that reflects the attacker's origin while allowing credentials, defeating same-origin protection.

AML.T0049

Unauthorized API access

The attacker's script uses the now-permitted cross-origin channel to reach the unauthenticated OpenAI-compatible API, run inference, enumerate models, and invoke connected MCP tools.

AML.T0053

Impact

Cross-origin responses are read by the attacker's page, exposing model output and potentially data or actions performed by invoked MCP tools.

AML.T0086

Reconnaissance

Attacker identifies a target running Jan's local API server, either by scanning the local network or by luring the victim to a page that will attempt DNS rebinding against the local server's port.

AML.T0006

CORS bypass

The victim's browser sends a cross-origin request to Jan's API; the server's trusted-host check is replaced by a wildcard that reflects the attacker's origin while allowing credentials, defeating same-origin protection.

AML.T0049

Unauthorized API access

The attacker's script uses the now-permitted cross-origin channel to reach the unauthenticated OpenAI-compatible API, run inference, enumerate models, and invoke connected MCP tools.

AML.T0053

Impact

Cross-origin responses are read by the attacker's page, exposing model output and potentially data or actions performed by invoked MCP tools.

AML.T0086

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C Low

I Low

A Low

What should I do?

1 step

Patch: upgrade Jan to the release containing commit 3e1c1e7 (fixed after 0.8.4) — verify the fix via the vendor commit and PR #8506 before considering this closed. Workarounds if patching is delayed: bind Jan's API server to 127.0.0.1 only (avoid 0.0.0.0/LAN binding), block the API port at the host firewall from other network hosts, and avoid keeping Jan's server running unattended while browsing untrusted or unknown websites (mitigates DNS rebinding). Detection: monitor Jan's local API access logs for requests bearing unexpected Origin headers or originating from browser-like user agents outside your own tooling, and review MCP tool invocation logs for calls not initiated by your own client. Harden further by disabling or scoping down MCP tools with destructive or data-exfiltration capability when not actively needed.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Code Execution API Agent Plugin AML.T0040 - AI Model Inference API Access AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.3 - AI system security controls

NIST AI RMF

MANAGE-4.1 - AI system risk monitoring and response

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-66005?

Jan's local API server ships with a broken CORS trusted-host check: instead of enforcing the user-configured allowlist, it silently swaps in a wildcard that reflects any requesting origin while still allowing credentials, which defeats the browser's same-origin protections entirely. A CISO should care because this turns 'it only listens locally' into a false assumption — any attacker on the same network segment, or a malicious website using DNS rebinding, can drive a victim's browser to reach the unauthenticated OpenAI-compatible endpoint and run inference, enumerate loaded models, and invoke connected MCP tools, then read the cross-origin responses. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this isn't under active mass exploitation, but the bug requires no credentials and only one instance of user interaction (visiting a page while Jan is running) to trigger — a low bar for a targeted attack against a developer or power user running local AI tooling. Upgrade to the version built from commit 3e1c1e7 (post-0.8.4) immediately; until then, don't run Jan's API server while browsing untrusted sites, bind it to loopback only and firewall off LAN access, and audit any MCP tool logs for unexpected cross-origin invocations.

Is CVE-2026-66005 actively exploited?

No confirmed active exploitation of CVE-2026-66005 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-66005?

Patch: upgrade Jan to the release containing commit 3e1c1e7 (fixed after 0.8.4) — verify the fix via the vendor commit and PR #8506 before considering this closed. Workarounds if patching is delayed: bind Jan's API server to 127.0.0.1 only (avoid 0.0.0.0/LAN binding), block the API port at the host firewall from other network hosts, and avoid keeping Jan's server running unattended while browsing untrusted or unknown websites (mitigates DNS rebinding). Detection: monitor Jan's local API access logs for requests bearing unexpected Origin headers or originating from browser-like user agents outside your own tooling, and review MCP tool invocation logs for calls not initiated by your own client. Harden further by disabling or scoping down MCP tools with destructive or data-exfiltration capability when not actively needed.

What systems are affected by CVE-2026-66005?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, local LLM inference.

What is the CVSS score for CVE-2026-66005?

CVE-2026-66005 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel servinglocal LLM inference

MITRE ATLAS Techniques

AML.T0040 AI Model Inference API Access

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects arbitrary origins with credentials. Attackers on the local network or using DNS rebinding can reach the unauthenticated OpenAI-compatible API to perform inference, enumerate models, invoke MCP tools, and read cross-origin responses.

Exploitation Scenario

A victim runs Jan locally with its API server active and several MCP tools connected (e.g., filesystem or web-fetch tools). The victim visits an attacker-controlled webpage, or resolves a domain the attacker controls via DNS rebinding so it appears to be same-origin. JavaScript on that page issues a cross-origin fetch to Jan's local API port; because Jan's CORS layer has replaced the trusted-host allowlist with a wildcard that reflects the request's Origin header while still permitting credentials, the browser allows the response to be read. The attacker's script then enumerates available models, submits inference requests, and invokes exposed MCP tools — for example, prompting a tool with filesystem access to read or exfiltrate local files, or a web-fetch tool to reach internal network resources — all while reading the JSON responses cross-origin, effectively turning the victim's browser into a remote control channel for their local AI agent.

Weaknesses (CWE)

CWE-183 Permissive List of Allowed Inputs Primary CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains Primary CWE-183 Permissive List of Allowed Inputs CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains

CWE-183 — Permissive List of Allowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Source: MITRE CWE corpus.