Llamafile's HTTP server has zero allowed.hosts configuration. Arbitrary Host: headers are accepted on all endpoints. An attacker with a domain that DNS-rebinds to 127.0.0.1 after initial fetch gets full cross-origin access via "same-origin" routing - bypassing browser SOP entirely. Same vulnerability class as the recently-filed ComfyUI DNS-rebinding bypass (F-029).

llamafile-0.10.1-thin (latest as of 2026-05-12).

CVSS 3.1 7.6 HIGH. Bypasses CORS protection entirely (rebound origin becomes same-origin from the browser's perspective). ML-multiplier eligible: model input/output exposure once same-origin is achieved.

Tony Davis (lendtrain on huntr) - 2026-05-12.