What happened
CVE-2026-66005 (CVSS 6.3/5.3, published July 24 2026) documents a CORS misconfiguration in Jan's local API server that undermines host-based access restrictions once the server is exposed beyond localhost, allowing unauthorized inference and MCP tool invocation.
Why it matters
Jan is a popular local LLM runner with MCP tool integration; this flaw allows any device on the local network (or via DNS rebinding from a malicious webpage) to silently invoke the user's configured MCP tools and read model outputs without authentication, a meaningful but narrowly-scoped (non-default-binding-dependent) exposure.
Attack vector
When Jan's local OpenAI-compatible API server is bound to 0.0.0.0, it replaces the user-configured trusted-hosts allowlist with a wildcard that reflects arbitrary origins with credentials, letting a network-adjacent attacker or DNS-rebinding attacker bypass host restrictions to perform inference, enumerate models, invoke MCP tools, and read cross-origin responses on the unauthenticated API.
Affected systems
Jan (janhq/jan) through 0.8.4, fixed in commit 3e1c1e7
Mitigation
Upgrade to the version containing commit 3e1c1e7; avoid binding the local API server to 0.0.0.0 unless required, and verify the Trusted Hosts allowlist is enforced.