Read the docs

LocalAI

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

LocalAI records in CISA KEV

No LocalAI vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-42580 CVE-2026-59707 · GHSA-8c5q-hx4g-qq23

LocalAI - Server-Side Request Forgery via POST /models/apply

Priority HIGH 79

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01383 Published 2026-07-07 Fixed in 1.40.1-0.20260703213242-2cbb3c96b34d CWE-918
TI-2026-78929 CVE-2026-114493 · GHSA-vhg8-m8fr-3863

SSRF guard bypass in LocalAI via HTTP redirects

Priority MEDIUM 46

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0038 Published 2026-10-21 No fix listed CWE-918
Open these records in search →