CVE-2026-59707 json
LocalAI - Server-Side Request Forgery via POST /models/apply
published 2026-07-07 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-42097 , GHSA-8c5q-hx4g-qq23 , GO-2026-6645
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges with partial response content leaked through error messages.
Patch / fix
- go github.com/mudler/LocalAI 1.40.1-0.20260703213242-2cbb3c96b34d
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template LocalAI < 4.6.0 - Server-Side Request Forgery nuclei detection template
- github.com https://github.com/mudler/LocalAI/issues/10665 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N |
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/mudler/LocalAI | <1.40.1-0.20260703213242-2cbb3c96b34d |
1.40.1-0.20260703213242-2cbb3c96b34d |
Affected products
- LocalAI LocalAI
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/mudler/LocalAI/commit/f9b968e19d7cbc556d59dceb2e0e450b828a3fda
patch, web
-
github.com
/mudler/LocalAI/issues/10665
issue-tracking, exploit, web, report
-
github.com
/mudler/LocalAI
product, package
-
vulncheck.com
/advisories/localai-server-side-request-forgery-via-post-models-apply
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-59707
advisory
-
github.com
/advisories/GHSA-8c5q-hx4g-qq23
advisory
Sources
- CVE List CVE-2026-59707
- GitHub Advisory GHSA-8c5q-hx4g-qq23
- NVD CVE-2026-59707
- OSV GO-2026-6645
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.