Skip to content
OpenAdvisories

Vendor

LocalAI

2 known vulnerabilities.

Products

LocalAI 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.6
    CVE-2026-114493

    LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects

    LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud…

    LocalAI LocalAI
  • High 8.6
    CVE-2026-59707 Scanner template

    LocalAI - Server-Side Request Forgery via POST /models/apply

    LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFro…

    LocalAI LocalAI github.com/mudler/LocalAI Go