CVE-2026-66005: Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that

Jan (a software tool) versions up to 0.8.4 have a CORS misconfiguration vulnerability (a security flaw where cross-origin requests, which normally have restrictions, are incorrectly allowed) in its local API server. Attackers on the same network can bypass security restrictions by exploiting how the server handles trusted hosts, allowing them to use the API without authentication to run AI tasks, see what models are available, and access responses they shouldn't normally see.