CVE-2026-114493: LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker who can send a POST request to the /models/apply endpoint can supply a gallery configuration URL. No authentication or user interaction requirement is indicated by the provided vector.
What access can an attacker gain through the vulnerable request?
The attacker can cause LocalAI to follow a redirect from an initially validated URL to an internal address or cloud metadata address. The resulting internal response is returned as gallery content, potentially exposing sensitive data.
Are all LocalAI deployments affected?
The affected versions are LocalAI v4.6.0 through v4.11.0. Exposure depends on whether an attacker can reach and submit requests to POST /models/apply.
How can I identify attempted exploitation?
Review requests to POST /models/apply for gallery configuration URLs that redirect to internal network endpoints or cloud metadata addresses. The vulnerability specifically relies on the redirect target not being validated after the initial URL check.