CVE-2026-108760
Description
A flaw was found in llamafarm. An insecure default configuration exposes the unauthenticated application programming interface (API) server on all network interfaces while ignoring host overrides. A network-adjacent attacker can connect directly to the management endpoints to permanently delete projects, alter datasets, and retrieve stored API keys. This issue primarily leads to permanent data loss, service disruption, and sensitive information disclosure.
Statement
Red Hat has rated this vulnerability as having an impact of Important because unauthenticated adjacent actors can reach management endpoints to extract sensitive credentials and cause unrecoverable loss of project data. Although exploitation requires adjacency rather than arbitrary routable access, the complete absence of access controls coupled with catastrophic availability loss warrants the Important classification. LlamaFarm is not packaged or deployed by default across Red Hat supported platforms.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Binding to the address 0.0.0.0 might be much broader access than intended by the developer or administrator, who might only be expecting the server to be reachable from a single interface/network.
Availability
Technical Impact: DoS: Amplification
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
