CVE-2026-108760 in LlamaFarm
Summary
by MITRE • 10/11/2026
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability in LlamaFarm versions through 0.0.34 represents a critical misconfiguration of network exposure combined with an authentication bypass mechanism inherent to the application's default settings. The core technical flaw lies in the FastAPI server binding to all available network interfaces, specifically 0.0.0.0, on port 14345 without requiring any form of user authentication by default. This configuration choice effectively exposes the internal management API directly to the local area network and potentially wider internet depending on firewall rules, allowing any network-adjacent actor to interact with sensitive administrative endpoints. Compounding this exposure is a silent failure in the command-line interface where environment variables or configuration overrides intended to restrict the host binding are ignored, ensuring that even if an administrator attempts to mitigate the risk by specifying a localhost-only bind address, the application continues to listen on all interfaces as originally coded.
From a technical perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials or Default Configuration, specifically regarding insecure default configurations that leave systems vulnerable until explicitly hardened by an operator who may not be aware of the risks. The absence of authentication on endpoints responsible for project and dataset management creates a direct path for unauthorized access to sensitive data structures. Attackers can exploit this lack of access control to enumerate existing projects, inspect stored provider API keys which are often treated as high-value secrets in AI infrastructure, and manipulate the state of datasets managed by the application. The silent discarding of host overrides indicates a deeper architectural oversight where configuration validation is either missing or incorrectly implemented, preventing standard operational security practices from mitigating the exposure.
The operational impact of this vulnerability is severe due to the breadth of actions available through the exposed API. Network-adjacent attackers can read stored provider API keys, which may grant access to external AI model providers and lead to further compromise of associated cloud accounts or incur significant financial costs through unauthorized usage. Furthermore, the ability to modify projects allows for data poisoning or logic manipulation within the application's context. The capability to trigger ingestion processes could be abused to cause denial-of-service conditions by flooding the system with processing requests. Most critically, the irreversibility of project deletion means that attackers can permanently destroy valuable datasets and configurations, leading to significant operational disruption and potential loss of intellectual property or training data essential for machine learning workflows.
To mitigate this vulnerability, immediate action is required to restrict network exposure until a patched version is deployed. Administrators should configure firewalls to block inbound traffic on port 14345 from untrusted networks, effectively isolating the service to localhost if it must remain running during patching windows. It is also advisable to review any custom deployment scripts or environment variables that attempt to override host bindings, as these are currently ineffective due to the software bug; instead, rely entirely on network-level controls until version 0.0.35 or later is installed. Long-term remediation involves upgrading LlamaFarm to a version where authentication is enforced by default and configuration overrides function correctly. Organizations should also audit their cloud provider API key usage for any signs of unauthorized access during the window when this vulnerability was present, rotating keys as a precautionary measure against potential credential theft. This incident highlights the importance of applying defense-in-depth principles, ensuring that even if application-level security controls are misconfigured or flawed, network segmentation and strict default configurations prevent exploitation by external actors.