Infra2026-09-21 · source-backed

llama.cpp's router was forwarding `--api-key-file` to child servers and 401ing its own internal calls.

Issue

2026-09-21

Confidence

source-backed

Sources

Redaction

redacted

Story

PR #28938 fixes unset_reserved_args() unsetting LLAMA_API_KEY but missing LLAMA_ARG_API_KEY_FILE, so children re-validated against file keys only and clients using --api-key got 401s. Worse, the router's own POST /v1/streams/lookup and DELETE /v1/stream carry no auth headers and were being silently rejected. The right invariant: in router mode, authentication belongs to the router, not the children.

Source trail

PR #28938 More from github.com

Entities

POST Worse

Provenance

Canonical issue: Ramsay Research Agent — September 21, 2026
AI generated: no
Story unit: 2026-09-21-llama-cpp-s-router-was-forwarding-api-key-file-to-child-servers-and-401ing-its-own-internal-call
Labels: source-backed, canonical briefing excerpt

Fetching from the wire…

llama.cpp's router was forwarding `--api-key-file` to child servers and 401ing its own internal calls.

Story

Related stories

The MCP Python SDK stopped following cross-origin redirects that carried your auth headers to another host.

Chainlit's MCP endpoint gives unauthenticated RCE, because the allowlist checks the executable and ignores the arguments.

Twenty GitHub advisories landed on PraisonAI in one day, and most of the auth silently does nothing.

LangChain drops its own SDK-wrapper policy for one integration

Six MCP CVEs in 36 hours, all the same three missing boundaries, and half of registered servers changed what they advertise

Kev ships 0.8B, 4B and 9B open-weight decision models that drop into TypeSafe's API, 1,684 stars in four days.

Source trail

Entities

Provenance

llama.cpp's router was forwarding `--api-key-file` to child servers and 401ing its own internal calls.

Story

Related stories

The MCP Python SDK stopped following cross-origin redirects that carried your auth headers to another host.

Chainlit's MCP endpoint gives unauthenticated RCE, because the allowlist checks the executable and ignores the arguments.

Twenty GitHub advisories landed on PraisonAI in one day, and most of the auth silently does nothing.

LangChain drops its own SDK-wrapper policy for one integration

Six MCP CVEs in 36 hours, all the same three missing boundaries, and half of registered servers changed what they advertise

Kev ships 0.8B, 4B and 9B open-weight decision models that drop into TypeSafe's API, 1,684 stars in four days.

Source trail

Entities

Provenance

Story

Related stories

The MCP Python SDK stopped following cross-origin redirects that carried your auth headers to another host.

Chainlit's MCP endpoint gives unauthenticated RCE, because the allowlist checks the executable and ignores the arguments.

Twenty GitHub advisories landed on PraisonAI in one day, and most of the auth silently does nothing.

LangChain drops its own SDK-wrapper policy for one integration

Six MCP CVEs in 36 hours, all the same three missing boundaries, and half of registered servers changed what they advertise

Kev ships 0.8B, 4B and 9B open-weight decision models that drop into TypeSafe's API, 1,684 stars in four days.

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance

Story

Related stories

The MCP Python SDK stopped following cross-origin redirects that carried your auth headers to another host.

Chainlit's MCP endpoint gives unauthenticated RCE, because the allowlist checks the executable and ignores the arguments.

Twenty GitHub advisories landed on PraisonAI in one day, and most of the auth silently does nothing.

LangChain drops its own SDK-wrapper policy for one integration

Six MCP CVEs in 36 hours, all the same three missing boundaries, and half of registered servers changed what they advertise

Kev ships 0.8B, 4B and 9B open-weight decision models that drop into TypeSafe's API, 1,684 stars in four days.

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance