CVE-2026-114493
LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Public exploit
- None on Exploit-DB
Summary
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.
Affected versions
- LocalAI LocalAI
From v4.6.0 · through v4.11.0