{"id":"CVE-2026-59707","kind":"vulnerability","aliases":["CVE-2026-59707","GHSA-8c5q-hx4g-qq23","GO-2026-6645"],"related":[],"title":"LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI","description":"LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges with partial response content leaked through error messages.","summary":"LocalAI's POST /models/apply endpoint takes gallery URLs without validation, so anyone who can reach it can make the server send HTTP GET requests to internal and loopback addresses. Partial response content comes back in error messages, which can expose internal services.","severity":"critical","cvss":9.2,"epss":0.00482,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/mudler/LocalAI","fixed":["1.40.1-0.20260703213242-2cbb3c96b34d"],"affected":"< 1.40.1-0.20260703213242-2cbb3c96b34d","ecosystem":"go"}],"ecosystems":["go"],"tags":["ai-tooling","go","llm-gateway","localai","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Check whether LocalAI is installed and reachable: go list -m github.com/mudler/LocalAI or inspect the running binary version.\nIf it is reachable from untrusted networks, test POST /models/apply is exposed without auth.","fix":"Upgrade github.com/mudler/LocalAI to 1.40.1-0.20260703213242-2cbb3c96b34d or later.\nUntil then, block external access to POST /models/apply at the network or reverse proxy layer.","status":"open","published_at":"2026-07-07T21:17:29+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:43:48+00:00","updated_at":"2026-10-23T21:43:48+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-23T21:43:48Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/mudler/LocalAI to 1.40.1-0.20260703213242-2cbb3c96b34d or later.\nUntil then, block external access to POST /models/apply at the network or reverse proxy layer.","reach":"internet","impact":"medium","summary":"LocalAI's POST /models/apply endpoint takes gallery URLs without validation, so anyone who can reach it can make the server send HTTP GET requests to internal and loopback addresses. Partial response content comes back in error messages, which can expose internal services.","category":"ai-tooling","who_cares":["go","self-hosted","localai","llm-gateway"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads internal services and error-leaked response data via server-side requests","analyst_note":"Confirm whether the endpoint is reachable without auth in default config and whether partial response leakage includes credentials; check GHSA-8c5q-hx4g-qq23 and GO-2026-6645 for details.","how_to_check":"Check whether LocalAI is installed and reachable: go list -m github.com/mudler/LocalAI or inspect the running binary version.\nIf it is reachable from untrusted networks, test POST /models/apply is exposed without auth.\nunknown for any further exposure check the sources do not describe.","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000563,"input_tokens":3020,"output_tokens":522,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,27A,30A '-59707':20A,31A '-6645':28A '/models/apply':3A,49B,101C '/mudler/localai':17A,34A '8c5q':23A 'address':74B 'ai':36B 'ai-tool':35B 'allow':104C 'anyon':57B 'arbitrari':108C 'attack':105C,125C 'back':79B 'come':78B 'contain':89C 'content':77B,143C 'cve':18A,29A 'direct':118C 'enabl':124C 'endpoint':50B,102C,112C 'error':81B,146C 'expos':85B 'fetch':107C 'field':117C 'forc':127C 'forgeri':10A,96C 'galleri':12A,52B,115C 'gallery.getgalleryconfigfromurlwithcontext':120C 'gateway':41B 'get':68B,133C 'ghsa':22A 'ghsa-8c5q-hx4g-qq23':21A 'github.com':16A,33A 'github.com/mudler/localai':15A,32A 'go':26A,38B 'host':45B 'http':67B,132C 'hx4g':24A 'intern':71B,86B,109C 'issu':131C 'leak':144C 'llm':40B 'llm-gateway':39B 'localai':1A,42B,46B,88C 'loopback':73B,138C 'make':63B 'messag':82B,147C 'partial':75B,141C 'pass':113C 'permit':4A 'post':2A,48B,100C 'privat':136C 'proper':122C 'qq23':25A 'rang':139C 'reach':60B 'request':9A,69B,95C,134C 'respons':76B,142C 'self':44B 'self-host':43B 'send':66B 'server':7A,65B,93C,129C 'server-sid':6A,92C 'servic':87B 'side':8A,94C 'take':51B 'tool':37B 'unauthent':5A,91C 'unsanit':114C 'url':13A,53B,110C,116C 'valid':55B,123C 'vulner':97C 'without':54B,121C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-07T21:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6645","url":"https://pkg.go.dev/vuln/GO-2026-6645","severity":null,"published_at":"2026-10-07T14:10:14+00:00","modified_at":"2026-10-07T14:10:14+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-59707","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59707","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-59707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59707","severity":null,"published_at":"2026-07-07T21:17:29+00:00","modified_at":"2026-07-10T18:22:49+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}