Vulnerabilidades do LocalAI LocalAI
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam LocalAI LocalAI: 2 registro(s), com versões afetadas e correções.
CVE-2026-114493
Alta · 8.6
CWE-918 21/10/2026
LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.
CVE-2026-59707
Alta · 8.6
Exploit público CWE-918 07/07/2026
LocalAI - Server-Side Request Forgery via POST /models/apply
LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges with partial response content leaked through error messages.