LlamaFarm CVE-2026-108760

Exploitable against a DEFAULT LlamaFarm deployment: the FastAPI server binds to 0.0.0.0 (all interfaces) on TCP port 14345 with no authentication, and the lf CLI silently ignores HOST overrides, so the default-exposed state persists even when an operator attempts to restrict the bind address. No authentication is required (PR:N confirmed by the CVSS vector), so any party who can reach port 14345 can invoke the full project/dataset management API. The primary LIMITING factor is the adjacent attack vector (AV:A): the attacker must already be on the same network segment or otherwise able to reach the host on 14345 (same LAN, shared subnet, or co-located container), not the open Internet, unless the port has been explicitly forwarded/exposed. No user interaction or non-default configuration is needed.

The vendor CVSS 4.0 score is 7.2 (High), driven by trivial exploitability (AC:L, AT:N, PR:N, UI:N) against an unauthenticated API combined with VA:H (irreversible project deletion). The single most important mitigating signal is AV:A: the attack vector is adjacent, not internet-wide, so exploitation requires a foothold on the same L2/local network segment (or a host/container exposed to one) rather than open Internet reachability - this materially lowers mass-exploitation potential. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation, and no public exploit code was supplied - only a technical disclosure write-up (hackmd) and the VulnCheck advisory, which document the flaw but are not weaponized POC. A notable internal tension: the description states attackers can read stored provider API keys, which is a meaningful confidentiality loss (and a pivot to external paid LLM/provider accounts), yet the vendor rated confidentiality only VC:L - verify whether the real-world blast radius of leaked credentials warrants a higher confidentiality rating. A second aggravating factor beyond raw CVSS is that the lf CLI silently discards HOST overrides, meaning operators who believe they have rebound the listener remain exposed - this defeats the obvious self-mitigation. Overall this is a genuine but situational priority: low barrier to exploit and destructive impact, bounded chiefly by the adjacent-only vector and the niche deployment footprint; prioritize for any LlamaFarm instance reachable on a shared or untrusted network segment.

An attacker with a foothold on the same network segment (e.g., a co-tenant container, a compromised workstation on the office LAN, or a shared cloud subnet) scans for the default LlamaFarm listener on TCP 14345, which binds to 0.0.0.0 with no authentication. They query the unauthenticated project/dataset management API to exfiltrate stored provider API keys, then modify projects and irreversibly delete them. No public exploit code was identified at time of analysis, but exploitation requires only ordinary HTTP requests and no special tooling.