CVE-2026-59707: LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs

The endpoint takes a JSON body with id and url. When id is empty, the gallery lookup is skipped and the server fetches url directly. The fetch runs in installModelFromRemoteConfig in core/services/galleryop/models.go, which calls gallery.GetGalleryConfigFromURLWithContext. No check requires a public destination. LocalAI already has utils.IsPublicIP in its CORS proxy and utils.ValidateExternalURL in the image download path, but neither is used here.

The default Docker deployment has no API key, so anyone who can reach the port can send the request. The reporter, testing v3.0.0 in Docker, saw their listener receive a GET from the LocalAI container. If the internal service returns something other than YAML, the job status error reflects up to about 30 bytes of the body, readable at /models/jobs/. That is a small leak per request, but enough to probe cloud metadata endpoints and internal admin services and read their first bytes.

The CVSS scope is changed because the requests originate from inside the network boundary. The result is internal reconnaissance and partial disclosure, not code execution. Servers with an API key set are not reachable without it, though the advisory data rates the flaw as unauthenticated for default setups.

Go module github.com/mudler/LocalAI below pseudo-version 1.40.1-0.20260703213242-2cbb3c96b34d, which means any release built before the 3 July 2026 fix. The reporter confirmed v3.0.0. The deployment is most exposed when run from the default Docker image with no API key and the port reachable. Check the module or image:

go list -m github.com/mudler/LocalAI
docker image ls | grep -i localai

For a running server, check the version it reports in its startup log.

Upgrade to a LocalAI build that includes commit 2cbb3c9 (pull request 10673), listed as 1.40.1-0.20260703213242-2cbb3c96b34d:

go get github.com/mudler/LocalAI@2cbb3c96b34d

For Docker, pull the newest image tag published after 3 July 2026. The reporter's suggested fix was applying utils.ValidateExternalURL to the URL in installModelFromRemoteConfig before the request. The sources name no workaround. Until you upgrade, set an API key, keep the port off untrusted networks, and block the server's access to metadata addresses such as 169.254.169.254.

Search access logs for POST /models/apply with an empty id and a url that points to loopback, private ranges or 169.254.169.254. Check /models/jobs/ entries for error messages that echo fragments of non-YAML content. On the network, look for outbound connections from the LocalAI host to internal addresses that nothing else makes. Cloud metadata access logs showing requests from the LocalAI instance are a strong signal.

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges with partial response content leaked through error messages.