CVE-2026-108760
LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces
CVSS Score
7.6
EPSS Score
0.0%
EPSS Percentile
0th
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.
| CWE | CWE-1327 |
| Vendor | llama-farm |
| Product | llamafarm |
| Published | Oct 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for llama-farm llamafarm
Be the first to know when new high vulnerabilities affecting llama-farm llamafarm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High
Affected Versions
llama-farm / llamafarm
0 ≤ 0.0.34
References
hackmd.io: https://hackmd.io/@haind03/llamafarm-default-all-interface-bind-unauthenticated-api github.com: https://github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/server/core/settings.py#L41-L42 github.com: https://github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/cli/cmd/orchestrator/services.go#L138-L149 github.com: https://github.com/llama-farm/llamafarm vulncheck.com: https://www.vulncheck.com/advisories/llamafarm-through-0.0.34-unauthenticated-api-exposed-on-all-interfaces
Credits
HaiND from the Post and Telecommunication Institute of Technology