Zero Radar
← feed
CriticalVulnerabilityCVE-2026-114493updated 25 Oct 2026, 19:06 UTC

LocalAI can be tricked into fetching internal server addresses

Someone could make the LocalAI server reach out to private parts of your network or cloud account on their behalf, and read what comes back. This can expose internal data such as cloud credentials.

Official, 2 sources
SeverityCriticalCVSS 9.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker submits URLSends config URL to /models/apply
  2. 2Initial URL passes checkOnly the first URL is validated
  3. 3Server follows redirectRedirect points to internal address
  4. 4Metadata response returnedInternal data comes back as gallery content
  5. ResultAttacker reads internal and cloud data

What happened

LocalAI versions 4.6.0 through 4.11.0 contain a server-side request forgery flaw in core/gallery/gallery.go. The gallery config URL is validated only before the first request, so a redirect can send the server to internal or cloud metadata addresses via POST /models/apply.

Why it is dangerous: An attacker can read responses from internal services and cloud metadata endpoints, which may reveal credentials and internal network details. Anyone running an affected LocalAI server that accepts requests from untrusted users is at risk.

Are you affected?

You are affected if you run LocalAI v4.6.0 through v4.11.0 and the POST /models/apply endpoint is reachable by users you do not fully trust.

LocalAI v4.6.0 through v4.11.0

What to do

  1. Check whether your LocalAI version is between 4.6.0 and 4.11.0.
  2. Update LocalAI to a version that fixes this issue, as listed in the official advisory GHSA-vhg8-m8fr-3863.
  3. Until updated, restrict access to POST /models/apply to trusted users and block the server from reaching internal and cloud metadata addresses.

Timeline

  1. 21 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 21 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 19:06 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-114493 · GHSA-vhg8-m8fr-3863
CVSS
9.2 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 18:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 19:06 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

LocalAI can be tricked into fetching internal server addresses · Zero Radar