CVE-2026-108760

Katalog CVE

CVSS 7.6 · High EPSS 0,24%

Kerentanan Binding to an Unrestricted IP Address. Skor CVSS 3.1 7.6 (High) menurut vulncheck.com.

Deskripsi (NVD)

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.

Rincian

Terbit di NVD

11 Oktober 2026

Terakhir diubah

11 Oktober 2026

Status NVD

Received

CVSS 3.1

7.6 (High), sumber vulncheck.com
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1327: Binding to an Unrestricted IP Address

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/llama-farm/llamafarm
• https://github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/cli/cmd/orchestrator/ser...
• https://github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/server/core/settings.py#...
• https://hackmd.io/@haind03/llamafarm-default-all-interface-bind-unauthenticated-api
• https://www.vulncheck.com/advisories/llamafarm-through-0.0.34-unauthenticated-api-exposed-on-all-interfaces