Check LocalAI Gallery Settings to Stop Server-Side Request Forgery Attack

An attacker exploiting CVE-2026-114493 gains unauthorized access to internal network resources by manipulating how LocalAI processes gallery configuration requests. The threat actor needs only to submit a malicious URL through the application's standard interface to trigger the redirect, bypassing intended access controls. This capability allows external systems to retrieve sensitive data from internal cloud infrastructure without direct network access to those services.

The vulnerability exists within the core gallery module of LocalAI, specifically in the file gallery.go, where the software validates only the initial configuration URL. According to the National Vulnerability Database, this flaw permits an attacker to submit a config URL that redirects to internal or cloud metadata addresses. The application then returns those internal responses as standard gallery content, effectively leaking private infrastructure details to the outside world.

Technical Context

The flaw is classified under CWE-918, which relates to server-side request forgery. This type of weakness occurs when a server accepts a user-supplied URL and makes a request to that destination without adequately verifying its safety. In this specific case, the software fails to restrict where the gallery configuration can point, allowing it to target internal endpoints that should remain inaccessible from the public internet.

Affected Versions

The issue impacts LocalAI versions 4.6.0 through 4.11.0. Any deployment running these releases is vulnerable to the described attack vector. The National Vulnerability Database has assigned a CVSS score of 9.2, rating the severity as critical. Users operating within this version range are advised to review their exposure immediately, as the vulnerability allows for significant data leakage from internal cloud environments.

What to watch

Monitor for any official announcements from the LocalAI development team regarding a patched version. If an update is released, apply it promptly to systems running versions 4.6.0 through 4.11.0. Until a fix is confirmed, consider restricting network access to the LocalAI instance to prevent unauthorized submission of gallery configurations. Keep an eye on security advisories for related vulnerabilities in similar AI model management platforms.

What made it possible

Teams usually encounter this class of risk when applications fetch external resources without strictly validating the target destination. Check whether your infrastructure relies on services that accept user-defined URLs for content retrieval. Ensure that these services cannot be directed toward internal network addresses or cloud metadata endpoints. This guidance helps prevent unauthorized data exfiltration by limiting the scope of where the application is allowed to connect.

Background: Security advisories

Security advisories provide the technical context needed to prioritize patches. They explain the severity, affected components, and mitigation steps. Without them, teams guess which fixes matter, leaving critical gaps open to exploitation while wasting time on low-risk updates.

Read the full guide: How Security Advisories Drive Patch Decisions and Reduce Risk

What to do and how to stay safe: LocalAI

• Verify if your LocalAI installation is running version 4.6.0 through 4.11.0 and isolate it from untrusted networks if so.
• Restrict access to the POST /models/apply endpoint to prevent unauthorized users from submitting malicious gallery configurations.
• Monitor network logs for unexpected outbound connections from the LocalAI server to internal metadata services or private IP ranges.
• Wait for an official patch from the vendor before re-exposing the service to broader user groups or public access.

Step-by-step guide: Risk-Based Vulnerability Management: How to Prioritize What to Fix First

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of LocalAI are affected by CVE-2026-114493?

Versions 4.6.0 through 4.11.0 are affected by this server-side request forgery vulnerability.

What is the severity rating for this vulnerability?

The National Vulnerability Database rates it as critical with a CVSS score of 9.2.

How do attackers exploit this flaw?

Attackers submit a malicious config URL through the POST /models/apply endpoint to redirect requests to internal metadata addresses.