{"cve":"CVE-2026-59707","nvd":{"published":"2026-07-07T21:17:29.340","modified":"2026-10-25T20:10:00.147","status":"Deferred","description":"LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges with partial response content leaked through error messages.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":9.2},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","score":8.6},"cwes":["CWE-918"],"references":["https://github.com/mudler/LocalAI","https://github.com/mudler/LocalAI/commit/f9b968e19d7cbc556d59dceb2e0e450b828a3fda","https://github.com/mudler/LocalAI/issues/10665","https://www.vulncheck.com/advisories/localai-server-side-request-forgery-via-post-models-apply","https://github.com/mudler/LocalAI/issues/10665"],"products":[],"source":"nvd","synced_at":"2026-10-25T23:44:34.550481224+00:00"},"epss":{"cve":"CVE-2026-59707","score":0.00482,"percentile":0.41249,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-8c5q-hx4g-qq23","url":"https://osv.dev/vulnerability/GHSA-8c5q-hx4g-qq23","summary":" LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs","modified":"2026-10-07T17:55:52.810868417Z","packages":[{"ecosystem":"Go","name":"github.com/mudler/LocalAI","purl":"pkg:golang/github.com/mudler/LocalAI","ranges":["<1.40.1-0.20260703213242-2cbb3c96b34d"],"fixed":["1.40.1-0.20260703213242-2cbb3c96b34d"]}]},{"id":"GO-2026-6645","url":"https://osv.dev/vulnerability/GO-2026-6645","summary":"LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI","modified":"2026-10-07T17:45:13.482040153Z","packages":[{"ecosystem":"Go","name":"github.com/mudler/LocalAI","purl":"pkg:golang/github.com/mudler/LocalAI","ranges":["<1.40.1-0.20260703213242-2cbb3c96b34d"],"fixed":["1.40.1-0.20260703213242-2cbb3c96b34d"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}