---
id: "CVE-2026-59707"
kind: "vulnerability"
aliases: ["CVE-2026-59707", "GHSA-8c5q-hx4g-qq23", "GO-2026-6645"]
title: "LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI"
severity: "critical"
cvss: 9.2
epss: 0.00482
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "github.com/mudler/LocalAI", "fixed": ["1.40.1-0.20260703213242-2cbb3c96b34d"], "affected": "< 1.40.1-0.20260703213242-2cbb3c96b34d", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["ai-tooling", "go", "llm-gateway", "localai", "self-hosted"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-07-07T21:17:29+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:43:48+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6645", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-59707", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59707", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI

LocalAI's POST /models/apply endpoint takes gallery URLs without validation, so anyone who can reach it can make the server send HTTP GET requests to internal and loopback addresses. Partial response content comes back in error messages, which can expose internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/mudler/LocalAI affected < 1.40.1-0.20260703213242-2cbb3c96b34d fixed 1.40.1-0.20260703213242-2cbb3c96b34d

## How to check

Check whether LocalAI is installed and reachable: go list -m github.com/mudler/LocalAI or inspect the running binary version.
If it is reachable from untrusted networks, test POST /models/apply is exposed without auth.

## Fix

Upgrade github.com/mudler/LocalAI to 1.40.1-0.20260703213242-2cbb3c96b34d or later.
Until then, block external access to POST /models/apply at the network or reverse proxy layer.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6645
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-59707
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59707

## From the sources

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges with partial response content leaked through error messages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_