LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces

Advisories

LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces

severity: high
date: 10/11/2026
Affecting: llamafarm <= 0.0.34
CVE: CVE-2026-108760
CWE: CWE-1327 Binding to an Unrestricted IP Address
CVSS: 7.2
CVSS V4 Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
References: https://hackmd.io/@haind03/llamafarm-default-all-interface-bind-unauthenticated-api
https://github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/server/core/settings.py#L41-L42
https://github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/cli/cmd/orchestrator/services.go#L138-L149
https://github.com/llama-farm/llamafarm
Credit: HaiND from the Post and Telecommunication Institute of Technology
Description: LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo