CVE-2026-59707: LocalAI Unauthenticated SSRF Vulnerability in /models/apply Endpoint

Technical summary

CVE-2026-59707 is an unauthenticated SSRF vulnerability in LocalAI's POST /models/apply endpoint. The vulnerability exists because the endpoint accepts a gallery URL parameter and passes it directly to gallery.GetGalleryConfigFromURLWithContext without sanitizing or validating the input. An attacker can supply a URL pointing to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.1), or link-local addresses (169.254.0.0/16). The server will issue an HTTP GET request to the attacker-supplied URL, and portions of the response—particularly error messages and partial content—are leaked back to the client. This allows reconnaissance of internal network topology, discovery of internal services, and potential credential or configuration theft depending on what those internal services expose.

Business impact

Organizations running LocalAI instances, particularly those deployed in cloud environments, containerized setups, or on shared infrastructure, face immediate risk of data exposure and lateral movement within their network. An attacker can discover and interact with internal services (databases, cache layers, metadata services, CI/CD systems) without authentication. In cloud deployments, this includes potential access to instance metadata services that contain temporary credentials, role information, and configuration data. Exploiting this vulnerability requires no authentication and can be triggered by any network-accessible LocalAI instance, making it a particularly attractive target for attackers performing reconnaissance during the initial access phase of an attack.

Affected systems

Any deployment of LocalAI is potentially affected by this vulnerability. The risk is highest for instances exposed to untrusted networks or the public internet. Internal-only deployments remain at risk if an attacker gains any form of network access. Cloud-native deployments—those running on AWS, Azure, GCP, or Kubernetes clusters—face amplified risk due to the presence of well-known metadata endpoints and internal service discovery mechanisms that become targets for SSRF exploitation.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no user interaction, and no special conditions beyond network accessibility to the vulnerable endpoint. An attacker can craft a simple HTTP POST request with a malicious URL in the gallery field. The attack is deterministic and repeatable. No special tools are required; basic HTTP client functionality suffices. The barrier to exploitation is extremely low, making this vulnerability likely to be exploited opportunistically as soon as details become public or are shared within attacker communities.

Remediation

Upgrade LocalAI to a patched version that validates and sanitizes gallery URL inputs. Verify against the official LocalAI project advisory for specific version numbers and timelines. As an interim measure, implement network-level controls: restrict outbound access from LocalAI instances to only required external services using firewall rules or security group policies; block access to private IP ranges and loopback addresses at the application or network layer; disable or restrict access to cloud metadata endpoints if running in a cloud environment. Additionally, restrict network access to the /models/apply endpoint to trusted sources only, and monitor outbound HTTP requests from LocalAI servers for suspicious destinations.

Patch guidance

Consult the official LocalAI project repository and security advisories for patched version availability and upgrade procedures. The fix will involve input validation and URL sanitization before the gallery URL is passed to internal functions. When patching is available, prioritize rapid deployment given the low barrier to exploitation and high severity rating. Test patches in a non-production environment first to ensure compatibility with your deployment model and configuration.

Detection guidance

Monitor LocalAI server logs for POST requests to /models/apply with unusual or suspicious gallery URL values, particularly those containing private IP addresses (10.*, 172.16.*, 192.168.*), loopback addresses (127.*), or link-local addresses (169.254.*). Look for error messages or unusual response patterns indicating failed HTTP requests to internal addresses. Network-level detection should flag outbound HTTP/HTTPS requests from LocalAI instances to private IP ranges, loopback addresses, or cloud metadata endpoints (169.254.169.254 on AWS, 169.254.169.254 on Azure, metadata.google.internal on GCP). Anomalous request patterns to the endpoint—high volume, rapid-fire requests to multiple different URLs, or requests from unexpected source IPs—may indicate automated scanning or exploitation attempts.

Why prioritize this

This vulnerability scores 8.6 CVSS (HIGH) and warrants immediate attention. The combination of zero authentication requirements, low attack complexity, and high confidentiality impact places it in the top tier of exploitability. The ability to access internal services and cloud metadata makes this a critical stepping stone for attackers. Organizations with internet-facing LocalAI instances should treat this as an urgent priority; even internal-only instances should be patched promptly.

Risk score, explained

The CVSS 3.1 score of 8.6 reflects: (1) Network accessibility with no authentication required (AV:N, PR:N), making the attack surface extremely broad; (2) Low attack complexity (AC:L), indicating the exploit requires no special conditions; (3) High confidentiality impact (C:H), as internal data and service responses are leaked; (4) Changed scope (S:C), as the attacker can potentially access resources beyond the LocalAI application boundary (internal services, cloud infrastructure). The absence of integrity and availability impact (I:N, A:N) reflects that this particular vulnerability is read-only; however, the information disclosed may enable further attacks that do compromise those properties.

Frequently asked questions