CVE-2026-108760
LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces
llama-farm llamafarm
CVSS
7.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.
Text from CVE List
Affected versions 1
- llamafarmaffected: all versions through 0.0.34CVE List
References 5
- hackmd.io/@haind03/llamafarm-default-all-interface-bind-unauthenticated-apiAdvisoryvia CVE List
- vulncheck.com/advisories/llamafarm-through-0.0.34-unauthenticated-api-exposed-on-all-interfacesAdvisoryvia CVE List
- github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/server/core/settings.py#L41-L42Referencevia CVE List
- github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/cli/cmd/orchestrator/services.go#L138-L149Referencevia CVE List
- github.com/llama-farm/llamafarmReferencevia CVE List