CVE-2026-108760

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108760

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108760.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108760

Published

2026-10-11T12:19:57Z

Modified

2026-10-13T02:45:36Z

Severity

7.2 (High) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces

Details

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-1327"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108760.json"
}

References

Affected packages

Git / github.com/llama-farm/llamafarm

Affected ranges

Type

GIT

Repo

https://github.com/llama-farm/llamafarm

Events

Introduced

Fixed

853e7eabdf70dd78054d93fabfa396452951377e

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "0.0.34"
        },
        {
            "fixed":  "0.0.34"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*

v0.0.1

v0.0.10

v0.0.11

v0.0.12

v0.0.13

v0.0.14

v0.0.15

v0.0.16

v0.0.17

v0.0.18

v0.0.19

v0.0.2

v0.0.20

v0.0.21

v0.0.22

v0.0.23

v0.0.24

v0.0.25

v0.0.26

v0.0.27

v0.0.28

v0.0.29

v0.0.3

v0.0.30

v0.0.31

v0.0.32

v0.0.33

v0.0.4

v0.0.5

v0.0.6

v0.0.7

v0.0.8

v0.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108760.json"