# llama.cpp v1.0.0: tools need an API key off loopback

> llama-server now refuses an unauthenticated tools setup on a LAN address, and keeps its CORS proxy away from localhost.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** llama.cpp
- **Disclosed:** 2026-11-13
- **Affects:** llama.cpp, llama-server
- **Research by:** [Xuan-Son Nguyen](https://github.com/ngxson)
- **Primary source:** https://github.com/ggml-org/llama.cpp/releases/tag/v1.0.0
- **Page:** https://theinjection.dev/items/llama-cpp-v1-0-0-server-hardening/

llama.cpp v1.0.0 refuses to start llama-server with tools or MCP on a non-loopback address unless an API key is set, and stops the CORS proxy and media URLs reaching private addresses. Maintainer Xuan-Son Nguyen wrote both changes.

## What happened

The llama.cpp project released v1.0.0 on November 13, 2026 with a group of server security changes. Maintainer Xuan-Son Nguyen wrote and merged the two main pull requests, 32113 and 32115, on November 12. Neither change carries a CVE.

## How it works

The CORS proxy and the media URLs accepted in chat completion input could previously resolve to any address, including loopback and LAN hosts, which is server-side request forgery. Version 1.0.0 refuses private targets unless the operator passes --media-allow-private-urls, and a reviewer reported that both a redirect to 127.0.0.1 and a DNS rebinding host were blocked. Separately, starting the server with tools or MCP enabled on a non-loopback address and no API key is now refused, and CORS origin matching checks the port as well as the host.

## Who is affected

Builds before v1.0.0 are exposed on any machine that also browses the web, because a visited page can drive the CORS proxy at internal addresses. Nguyen writes that the original design assumed operators would sandbox llama-server, while many now run it on personal computers. Anyone who bound the server to 0.0.0.0 with tools enabled and no key was serving those tools to the network.

## What to do

Update to llama.cpp v1.0.0. If start-up now fails because tools or MCP are enabled on a non-loopback address, set an API key rather than passing --allow-unauthenticated-tools. Anything that relied on the CORS proxy to reach a localhost or LAN MCP server needs CORS enabled on that server instead.

## Quick facts

- **Affected:** llama.cpp builds before v1.0.0, in llama-server
- **Fixed in:** v1.0.0, released November 13, 2026
- **CVE:** None assigned
- **Found by:** Xuan-Son Nguyen, llama.cpp maintainer
- **New flags:** --allow-unauthenticated-tools and --media-allow-private-urls, both opt-in
- **Attack type:** Server-side request forgery through the CORS proxy and media URLs

## Sources

1. [Release v1.0.0](https://github.com/ggml-org/llama.cpp/releases/tag/v1.0.0)
2. [PR 32115: SSRF Fix](https://github.com/ggml-org/llama.cpp/pull/32115)
3. [PR 32113: Tools Opt-In](https://github.com/ggml-org/llama.cpp/pull/32113)