Which versions of LocalAI are affected by CVE-2026-59707?

LocalAI's /models/apply endpoint contains an unauthenticated server-side request forgery vulnerability (CVSS 9.2 Critical) allowing remote attackers to access internal backend services and private…. A patch is available.

How to fix or mitigate CVE-2026-59707?

24 hours: Inventory all LocalAI instances and their network exposure; apply immediate network segmentation if patching cannot begin immediately. 7 days: Apply vendor-released patch to all affected LocalAI deployments (coordinate with vendor for specific patched version). 30 days: Audit application logs and security monitoring for exploitation attempts (focus on GET requests to internal IP ranges via /models/apply); validate patch deployment across all instances; re-scan for vulnerability confirmation.

LocalAI CVE-2026-59707

Q: What is the CVSS score of CVE-2026-59707?

CVE-2026-59707 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42097 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-07 VulnCheck

GHSA-8c5q-hx4g-qq23

SSRF Localai

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Remote, low-complexity, unauthenticated SSRF; scope changes as the server pivots to internal systems (S:C) with high confidentiality via leaked responses, and no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 21:30 vuln.today

DescriptionCVE.org

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges with partial response content leaked through error messages.

AnalysisAI

Server-side request forgery in LocalAI's POST /models/apply endpoint lets unauthenticated remote attackers coerce the server into issuing HTTP GET requests to arbitrary internal, private, and loopback addresses, with partial response bodies disclosed back through error messages. The flaw stems from passing attacker-controlled gallery URL fields into gallery.GetGalleryConfigFromURLWithContext without validation, giving attackers a network pivot from the internet into otherwise unreachable back-end services. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and the CVSS 4.0 base score is 9.2 (Critical).

Technical ContextAI

LocalAI is a self-hosted, OpenAI-compatible inference server (Go, project mudler/LocalAI) that exposes a model 'gallery' feature allowing operators to install models by supplying a remote gallery manifest URL. The /models/apply handler takes the user-supplied gallery URL and hands it directly to the internal gallery.GetGalleryConfigFromURLWithContext fetcher, which performs a server-side HTTP GET. Because the URL is neither validated against an allowlist nor filtered to block private/loopback address ranges, the server can be steered to any destination it can reach - the classic root cause of CWE-918 (Server-Side Request Forgery). The single affected CPE is cpe:2.3:a:localai:localai (all versions prior to the patched build).

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor fix in commit https://github.com/mudler/LocalAI/commit/f9b968e19d7cbc556d59dceb2e0e450b828a3fda by upgrading to a LocalAI build that includes it, then confirm the exact tagged release via the VulnCheck advisory (https://www.vulncheck.com/advisories/localai-server-side-request-forgery-via-post-models-apply) and issue #10665. Until patched, restrict who can reach the /models/apply endpoint by placing LocalAI behind an authenticating reverse proxy or network ACL so it is not internet-exposed (trade-off: breaks any workflow relying on anonymous model installation); egress-filter the LocalAI host so it cannot initiate outbound connections to RFC1918, loopback, link-local (169.254.0.0/16, including cloud metadata 169.254.169.254), and other internal ranges (trade-off: legitimate remote gallery fetches to allowed hosts must be explicitly permitted); and disable or lock down the model gallery/apply feature if it is not needed operationally.