CVE-2026-114493 — LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can …
Published: 2026-10-21 · CVSS: 9.2 · CVSS 4.0
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7