CVE-2026-114493
CVE-2026-114493 · LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.
CVSS 9.2 · Crítica · EPSS 0,4%
- Publicación
- Actualización
Productos y versiones afectados
localai
- Versiones
- ≥ v4.6.0, ≤ v4.11.0: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://github.com/mudler/LocalAI/pull/12791
- https://github.com/mudler/LocalAI/blob/v4.11.0/core/gallery/gallery.go#L26-L57
- https://github.com/mudler/LocalAI/blob/v4.11.0/pkg/downloader/uri.go#L196-L212
- https://github.com/mudler/LocalAI/blob/v4.11.0/pkg/httpclient/client.go#L81-L92
- https://www.vulncheck.com/advisories/localai-4.6.0-through-4.11.0-ssrf-guard-bypass-via-http-redirects
- https://nvd.nist.gov/vuln/detail/CVE-2026-114493