LocalAI vulnerabilities
We track 2 vulnerabilities in LocalAI products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 21, 2026.
2vulnerabilities
0critical
2high
0exploited
8.6average CVSS score
Latest LocalAI vulnerabilities
- 8.6 High severity
LocalAI: Server-Side Request Forgery
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud
- 8.6 High severity
LocalAI: Server-Side Request Forgery
LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFrom