openyak CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL openyak CVE published 2026-08-07

CVE-2026-46409

CVE-2026-46409 is a critical vulnerability in OpenYak, a local-first agent runtime for reliable tool-using models. The vulnerability allows for remote code execution via cross-origin requests to a local server bound to `127.0.0.1:<random port>` without proper validation or authentication. This issue was patched in version 1.1.3. Users of OpenYak versions prior to 1.1.3, particularly those using the deskto [truncated]