LocalAI EUVD-2026-107421

Exploitation requires network reachability to the LocalAI model-management API, specifically the POST /models/apply endpoint, and the attacker must supply a gallery config URL whose server issues an HTTP redirect to an internal, loopback, link-local, or cloud-metadata address (e.g. 169.254.169.254). The flaw triggers only on gallery index/config reads over HTTP(S) in affected versions v4.6.0-v4.11.0, because only the initial config URL was validated while net/http silently followed redirects to unvalidated hops; per the patch, model weight downloads in files[].uri follow a separate redirect policy and are not the vector here. Limiting factors: the API endpoint must be exposed to the attacker (many LocalAI instances bind to localhost or sit on internal networks), the attacker must control or influence a redirecting server, and the high-value outcome assumes the LocalAI host actually has reachable internal services or a cloud metadata endpoint.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, base 9.2) describes a remote, low-complexity, unauthenticated SSRF with high confidentiality impact on both the vulnerable system and a subsequent system (SC:H), which is consistent with the CWE-918 classification and the described ability to read internal/cloud-metadata responses. The exploitation signals are mixed by absence: no EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis' - the finding is credible research from VulnCheck with a confirmed vendor patch (PR #12791) rather than observed in-the-wild activity. One caveat tempers the raw score: although PR:N marks this unauthenticated, real-world risk depends on whether the LocalAI API (POST /models/apply) is network-exposed, since many LocalAI instances are bound to localhost or sit behind internal networks; where the API is reachable, SSRF to cloud metadata endpoints (e.g. 169.254.169.254) is a high-value credential-theft primitive. Net: prioritize patching on any internet- or multi-tenant-exposed LocalAI, treat as lower urgency for strictly localhost deployments.

An attacker who can reach a LocalAI instance's model-apply API submits a gallery configuration URL pointing at an attacker-controlled server that returns an HTTP 302 redirect to an internal address such as the cloud metadata service (169.254.169.254). Because only the initial URL was validated and redirects were resolved inside net/http without re-checking each hop, LocalAI fetches the internal endpoint and returns its contents as gallery data, exposing IMDS credentials or internal services. No public exploit code was identified, but the redirect-bypass technique is straightforward to reproduce from the advisory and patch.