High severity8.6NVD Advisory· Published Jul 7, 2026· Updated Jul 10, 2026
CVE-2026-59707
CVE-2026-59707
Description
LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges with partial response content leaked through error messages.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/mudler/LocalAIGo | < 1.40.1-0.20260703213242-2cbb3c96b34d | 1.40.1-0.20260703213242-2cbb3c96b34d |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-8c5q-hx4g-qq23ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-59707ghsaADVISORY
- github.com/mudler/LocalAI/commit/f9b968e19d7cbc556d59dceb2e0e450b828a3fdanvdWEB
- github.com/mudler/LocalAI/issues/10665nvdWEB
- www.vulncheck.com/advisories/localai-server-side-request-forgery-via-post-models-applynvdWEB
News mentions
0No linked articles in our index yet.