CVE-2026-108760Published
LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-108760 · Microsoft / collected KEV context
cve-program · CVE-2026-108760
- https://hackmd.io/@haind03/llamafarm-default-all-interface-bind-unauthenticated-api
- https://github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/server/core/settings.py#L41-L42
- https://github.com/llama-farm/llamafarm/blob/853e7eabdf70dd78054d93fabfa396452951377e/cli/cmd/orchestrator/services.go#L138-L149
- https://github.com/llama-farm/llamafarm
- https://www.vulncheck.com/advisories/llamafarm-through-0.0.34-unauthenticated-api-exposed-on-all-interfaces
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.