LocalAI vulnerabilities

2 known vulnerabilities in LocalAI from LocalAI. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  LocalAI: Server-Side Request Forgery

  CVE-2026-114493Oct 21, 2026LocalAI

  LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud

• 8.6 High severity

  LocalAI: Server-Side Request Forgery

  CVE-2026-59707Jul 7, 2026LocalAIEPSS 1.38%

  LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFrom