Which versions of Localgpt are affected by CVE-2026-5000?

Organizations using PromtEngineer localGPT should be aware of notable risk from CVE-2026-5000, a missing authentication vulnerability rated CVSS 6.9.

How to fix or mitigate CVE-2026-5000?

Within 30 days: Identify affected systems running PromtEngineer localGPT and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Localgpt CVE-2026-5000

Q: What is the CVSS score of CVE-2026-5000?

CVE-2026-5000 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-16929 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-03-28 VulDB

GHSA-wwwf-53m5-vmfq

Authentication Bypass Localgpt Promtengineer

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 28, 2026 - 15:15 euvd

EUVD-2026-16929

Analysis Generated

Mar 28, 2026 - 15:15 vuln.today

CVE Published

Mar 28, 2026 - 15:00 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. Impacted is the function LocalGPTHandler of the file backend/server.py of the component API Endpoint. The manipulation of the argument BaseHTTPRequestHandler results in missing authentication. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authentication bypass in PromtEngineer localGPT affects the LocalGPTHandler API endpoint in backend/server.py, allowing unauthenticated remote attackers to access protected functionality with low confidentiality, integrity, and availability impact. The vulnerability stems from improper validation of the BaseHTTPRequestHandler argument, enabling attackers to manipulate request handling without credentials. No public exploit code or active exploitation has been confirmed, though the vendor has not responded to disclosure efforts.

Technical ContextAI

LocalGPT is a Python-based application utilizing BaseHTTPRequestHandler from the http.server module for handling HTTP requests in its API endpoint architecture. The vulnerability is rooted in CWE-306 (Missing Authentication for Critical Function), where the LocalGPTHandler fails to properly validate or enforce authentication credentials when processing incoming API requests. The improper handling of the BaseHTTPRequestHandler parameter suggests that request validation logic either does not check authentication tokens, API keys, or session credentials before allowing access to backend functions. This is a common pattern in Python web applications where developer-implemented authentication checks are bypassed or missing entirely in certain code paths.

RemediationAI

Users should immediately update to a commit version more recent than 4d41c7d1713b16b216d8e062e51a5dd88b20b054 by pulling the latest upstream code from the PromtEngineer repository on GitHub. Since the vendor has not provided versioned releases or formal patch communications, users must monitor the GitHub repository directly for security-related commits that address authentication handling in backend/server.py. As an interim mitigation, restrict network access to the localGPT API endpoint using a firewall, reverse proxy, or network policy to allow only trusted clients. Consider running localGPT in a network-isolated environment (local development only) until a confirmed fix is deployed. Refer to https://github.com/August829/CVEP/issues/8 for community discussion and potential updates on remediation status.