LocalAI: Server-side request forgery via HTTP redirects in gallery config fetch

Summary

LocalAI versions 4.6.0 through 4.11.0 validate only the initial gallery config URL, not the redirect targets that follow it. An attacker who can submit a config URL through POST /models/apply can redirect the server to internal or cloud metadata addresses and receive those responses as gallery content. The main risk is disclosure of internal data and cloud metadata credentials, and the risk is highest where the endpoint is reachable from untrusted networks.

Affected

• LocalAI v4.6.0 to v4.11.0 (CNA record: affected v4.6.0 up to and including v4.11.0)
• The CNA record states the default configuration is unaffected; the trigger conditions are not fully confirmed.

Fixed in

Unknown. No confirmed fixed release found.

• Fix candidate: PR #12791 (merge and release status not confirmed).

Workaround

No vendor-stated workaround found.

• Do not expose LocalAI directly to the internet.
• Restrict outbound traffic from the LocalAI host, including access to link-local metadata and internal address ranges.
• Restrict access to the model gallery endpoint or limit gallery sources to trusted ones.

Exploitation

• No public proof of concept found.
• Not known to be exploited in the wild; CISA SSVC: exploitation none, automatable yes.
• VulDB estimates exploitation is easy and requires no authentication (third-party estimate).

Our recommendation

• Identify all LocalAI instances and their exact versions; versions 4.6.0 to 4.11.0 are affected.
• Remove internet exposure first, placing LocalAI behind an authenticated reverse proxy or VPN.
• Block outbound access from the host to metadata and internal address ranges.
• Upgrade once a fixed release is confirmed in the LocalAI releases page.
• Check CVE-2026-59707 (unauthenticated SSRF in POST /models/apply) against your version as well.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory: LocalAI SSRF guard bypass via HTTP redirects www.vulncheck.com
• LocalAI fix candidate PR #12791 github.com
• LocalAI gallery.go at v4.11.0 github.com
• LocalAI downloader uri.go at v4.11.0 github.com
• LocalAI HTTP client at v4.11.0 github.com
• LocalAI releases github.com
• VulDB entry 424934 vuldb.com
• OpenCVE CVE-2026-114493 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:07.