Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108760LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces

High 7.6

In plain English

A high-severity security flaw in llamafarm from llama-farm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.2%top 84.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.

Affected products (as reported)

Vendor	Product	Versions
llama-farm	llamafarm	0 – through 0.0.34

Weakness: CWE-1327 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References

https://hackmd.io/@haind03/llamafarm-default-all-interface-bind-unauthenticated-api third-party-advisory
https://github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/server/core/settings.py#L41-L42 technical-description
https://github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/cli/cmd/orchestrator/services.go#L138-L149 technical-description
https://github.com/llama-farm/llamafarm product
VulnCheck Advisory: LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces third-party-advisory