{"id":"CVE-2026-114493","kind":"vulnerability","aliases":["CVE-2026-114493"],"related":[],"title":"LocalAI: gallery config redirects let attackers reach internal and cloud metadata","description":"LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.","summary":"LocalAI validates only the first gallery config URL, so a request to POST /models/apply can redirect the server to internal addresses or cloud metadata endpoints. An attacker can read those internal responses back as gallery content, which can expose cloud credentials.","severity":"critical","cvss":9.2,"epss":0.0038,"exploited":false,"exploited_at":null,"products":[{"name":"LocalAI","fixed":[],"affected":">= 4.6.0, <= 4.11.0","ecosystem":"github"}],"ecosystems":["github"],"tags":["ai-tooling","cloud","localai","self-hosted","ssrf"],"not_affected_if":["no-network-exposure","version-outside-4.6.0-4.11.0"],"how_to_check":"Check the LocalAI version the team runs: if it is between v4.6.0 and v4.11.0 inclusive, it is affected.","fix":"Upgrade LocalAI to a version later than v4.11.0; the fixed version is unknown from the sources.\nUntil upgraded, block POST /models/apply from untrusted networks.","status":"open","published_at":"2026-10-21T18:17:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:33:02+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-23T22:33:02Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade LocalAI to a version later than v4.11.0; the fixed version is unknown from the sources.\nUntil upgraded, block POST /models/apply from untrusted networks.","reach":"network","title":"LocalAI: gallery config redirects let attackers reach internal and cloud metadata","impact":"high","summary":"LocalAI validates only the first gallery config URL, so a request to POST /models/apply can redirect the server to internal addresses or cloud metadata endpoints. An attacker can read those internal responses back as gallery content, which can expose cloud credentials.","category":"ai-tooling","who_cares":["localai","self-hosted","cloud","ssrf"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads cloud metadata and internal service responses, potentially stealing credentials","analyst_note":"Find the fixed LocalAI version and whether POST /models/apply requires auth; check the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-114493 for the fixed version and auth details.","how_to_check":"Check the LocalAI version the team runs: if it is between v4.6.0 and v4.11.0 inclusive, it is affected.\nunknown","needs_analyst":true,"not_affected_if":["version-outside-4.6.0-4.11.0","no-network-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000554,"input_tokens":2992,"output_tokens":509,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether POST /models/apply requires authentication, using the LocalAI GitHub advisory or NVD entry.","search":"'-114493':14A,17A '-2026':13A,16A '/models/apply':41B,99C 'address':48B,107C 'ai':20B 'ai-tool':19B 'attack':6A,54B,91C 'back':60B 'cloud':10A,22B,50B,67B,105C 'config':3A,34B,89C,95C 'contain':73C 'content':63B,114C 'core/gallery/gallery.go':82C 'credenti':68B 'cve':12A,15A 'endpoint':52B 'expos':66B 'first':32B 'forgeri':79C 'galleri':2A,33B,62B,88C,113C 'host':26B 'initi':87C 'intern':8A,47B,58B,103C,110C 'let':5A 'localai':1A,18A,23B,28B,69C 'metadata':11A,51B,106C 'post':40B,98C 'reach':7A 'read':56B 'receiv':108C 'redirect':4A,43B,101C 'request':38B,78C 'respons':59B,111C 'self':25B 'self-host':24B 'server':45B,76C 'server-sid':75C 'side':77C 'ssrf':27B 'submit':93C 'tool':21B 'url':35B,90C,96C 'v4.11.0':72C 'v4.6.0':70C 'valid':29B,84C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114493","severity":null,"published_at":"2026-10-21T18:17:28+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114493:173","url":null,"severity":null,"published_at":"2026-10-23T22:11:17+00:00","modified_at":"2026-10-23T22:11:17+00:00","first_seen_at":"2026-10-23T22:11:17+00:00","fetched_at":"2026-10-23T22:11:17+00:00","note":"VulnCheck CNA advisory + PR 12791 read. Affected v4.6.0-v4.11.0. No fixed release yet: fix PR 12791 still open as of 2026-10-21 (maintainer bot signed off). Auth: unauthenticated in default Docker (no API key set), per PR 10673 for the earlier #10665 SSRF. No exploitation or PoC found; x/social not searched."},{"source":"epss","external_id":"CVE-2026-114493","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114493","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1314,"url":"https://www.vulncheck.com/advisories/localai-4.6.0-through-4.11.0-ssrf-guard-bypass-via-http-redirects","title":"VulnCheck: LocalAI SSRF guard bypass via HTTP redirects","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1315,"url":"https://github.com/mudler/LocalAI/pull/12791","title":"PR 12791: re-validate external URL policy on every redirect hop (open)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1316,"url":"https://github.com/mudler/LocalAI/pull/10673","title":"PR 10673: initial SSRF fix for /models/apply (#10665); default Docker has no API key","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}