llama.cpp v1.0.0: tools need an API key off loopback
llama-server now refuses an unauthenticated tools setup on a LAN address, and keeps its CORS proxy away from localhost.
· llama.cpp · Research by Xuan-Son Nguyen
llama.cpp v1.0.0 refuses to start llama-server with tools or MCP on a non-loopback address unless an API key is set, and stops the CORS proxy and media URLs reaching private addresses. Maintainer Xuan-Son Nguyen wrote both changes.
01What happened
The llama.cpp project released v1.0.0 on November 13, 2026 with a group of server security changes. Maintainer Xuan-Son Nguyen wrote and merged the two main pull requests, 32113 and 32115, on November 12. Neither change carries a CVE.
02How it works
The CORS proxy and the media URLs accepted in chat completion input could previously resolve to any address, including loopback and LAN hosts, which is server-side request forgery. Version 1.0.0 refuses private targets unless the operator passes --media-allow-private-urls, and a reviewer reported that both a redirect to 127.0.0.1 and a DNS rebinding host were blocked. Separately, starting the server with tools or MCP enabled on a non-loopback address and no API key is now refused, and CORS origin matching checks the port as well as the host.
03Who is affected
Builds before v1.0.0 are exposed on any machine that also browses the web, because a visited page can drive the CORS proxy at internal addresses. Nguyen writes that the original design assumed operators would sandbox llama-server, while many now run it on personal computers. Anyone who bound the server to 0.0.0.0 with tools enabled and no key was serving those tools to the network.
04What to do
Update to llama.cpp v1.0.0. If start-up now fails because tools or MCP are enabled on a non-loopback address, set an API key rather than passing --allow-unauthenticated-tools. Anything that relied on the CORS proxy to reach a localhost or LAN MCP server needs CORS enabled on that server instead.
Sources 3 links, all fetched
- 1github.comRelease v1.0.0
- 2github.comPR 32115: SSRF Fix
- 3github.comPR 32113: Tools Opt-In