Server-Side Request Forgery Vulnerability in LocalAI by Mudler

CVE-2026-114493

What is CVE-2026-114493?

LocalAI versions 4.6.0 through 4.11.0 contain a server-side request forgery vulnerability located in the gallery component. This issue arises from the system's validation process, which only checks the initial gallery configuration URL. An attacker can exploit this flaw by submitting a malicious config URL through the POST method at /models/apply. This alteration could enable redirection to internal or cloud metadata addresses, allowing the attacker to capture sensitive internal responses as gallery content. Organizations utilizing vulnerable versions of LocalAI are encouraged to apply relevant patches and maintain security best practices.

References