LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.
CVE-2026-108760
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-108760
llamafarm
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/llama-farm/llamafarm",
"vendor": "llama-farm",
"product": "llamafarm",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "0.0.34"
}
],
"packageURL": "pkg:github/llama-farm/llamafarm",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-108760
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #22282 · Revision 1
- Added to Heist Feed
- Publisher date