CVE-2024-6095: Mudler LocalAI SSRF Vulnerability

CVE-2024-6095 Overview

CVE-2024-6095 is a Server-Side Request Forgery (SSRF) vulnerability in the /models/apply endpoint of mudler/LocalAI version 2.15.0. The endpoint accepts URLs using both http(s):// and file:// schemes without validating the request destination. An attacker with network access to a LocalAI instance can abuse the file:// scheme to achieve partial Local File Inclusion (LFI), reading fragments of local files through error message responses. The http(s):// scheme enables probing of internal HTTP services otherwise unreachable from outside the host. The flaw is tracked under CWE-918 and was fixed in version 2.17.

Critical Impact
Unauthenticated network attackers can reach internal HTTP(S) services and read partial contents of local files on the LocalAI host.

Affected Products

mudler LocalAI version 2.15.0
mudler LocalAI versions prior to 2.17
Deployments exposing the /models/apply endpoint to untrusted networks

Discovery Timeline

2024-07-06 - CVE-2024-6095 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6095

Vulnerability Analysis

The /models/apply endpoint accepts a gallery model definition that includes a URL field. LocalAI passes this URL directly to the pkg/downloader component without scheme restrictions or path sanitization. The downloader honors both remote http(s):// requests and local file:// reads using the same code path.

Attackers submitting a crafted URL can force the server to issue outbound requests to internal services. When the file:// scheme is used, the downloader attempts to open local files relative to the process working directory. Although full file content is not returned to the attacker, portions appear inside parser error messages when the file does not conform to the expected YAML gallery schema.

This combination exposes two attack surfaces: network reconnaissance against internal infrastructure and partial exfiltration of host-side configuration or secrets.

Root Cause

The GetGalleryConfigFromURL and GetRemoteLibraryShorteners functions invoked downloader.GetURI without a basePath constraint. Any URL passed by a client was dereferenced in-process by the server. There was no scheme allowlist, host allowlist, or base directory restriction for file:// reads.

Attack Vector

Exploitation requires only network access to the LocalAI API. An attacker issues a POST request to /models/apply with a crafted url pointing at either an internal HTTP endpoint or a local file path using the file:// scheme. The server resolves the URL server-side and either reaches the targeted internal service or returns parsed error fragments containing local file content.

// Security patch in core/services/gallery.go
// Source: https://github.com/mudler/localai/commit/2fc6fe806b903ac0a70218b21b5c84443a1b0866

func prepareModel(modelPath string, req gallery.GalleryModel, cl *config.BackendConfigLoader, downloadStatus func(string, string, string, float64)) error {

-	config, err := gallery.GetGalleryConfigFromURL(req.URL)
+	config, err := gallery.GetGalleryConfigFromURL(req.URL, modelPath)
 	if err != nil {
 		return err
 	}

// Security patch in embedded/embedded.go — downloader now respects basePath for file:// URLs
// Source: https://github.com/mudler/localai/commit/2fc6fe806b903ac0a70218b21b5c84443a1b0866

-func GetRemoteLibraryShorteners(url string) (map[string]string, error) {
+func GetRemoteLibraryShorteners(url string, basePath string) (map[string]string, error) {
 	remoteLibrary := map[string]string{}

-	err := downloader.GetURI(url, func(_ string, i []byte) error {
+	err := downloader.GetURI(url, basePath, func(_ string, i []byte) error {
 		return yaml.Unmarshal(i, &remoteLibrary)
 	})

The patch threads a basePath parameter through the downloader stack, confining file:// reads to the configured model directory.

Detection Methods for CVE-2024-6095

Indicators of Compromise

POST requests to /models/apply containing a url parameter with the file:// scheme.
POST requests to /models/apply referencing internal IP ranges (RFC1918), link-local 169.254.0.0/16, or localhost/127.0.0.1.
LocalAI error log entries containing YAML parse failures with fragments of system file content such as /etc/passwd or application config paths.

Detection Strategies

Inspect reverse proxy and application logs for /models/apply traffic from unexpected source addresses or automation user agents.
Alert on any LocalAI request body matching the regex pattern url"?\s*:\s*"file://.
Correlate outbound connections initiated by the LocalAI process against an allowlist of expected model gallery hosts.

Monitoring Recommendations

Enable verbose request logging on LocalAI and forward to a centralized log platform for query and retention.
Monitor the LocalAI service account for file reads outside its model directory using host-based auditing (auditd, Falco, or equivalent).
Track egress network flows from LocalAI hosts and flag connections to internal management interfaces or metadata services such as 169.254.169.254.

How to Mitigate CVE-2024-6095

Immediate Actions Required

Upgrade mudler/LocalAI to version 2.17 or later, which enforces basePath on file:// downloads.
Restrict network reachability of the LocalAI API to trusted administrators only; do not expose /models/apply to the public internet.
Audit historical access logs for prior exploitation attempts against /models/apply.

Patch Information

The fix is contained in upstream commit 2fc6fe806b903ac0a70218b21b5c84443a1b0866 and shipped in LocalAI v2.17. The patch threads a basePath argument through GetGalleryConfigFromURL, GetRemoteLibraryShorteners, and downloader.GetURI so that file:// URLs are resolved relative to the configured model path rather than the process root. Additional context is available in the Huntr bounty disclosure.

Workarounds

Place LocalAI behind an authenticated reverse proxy that blocks requests to /models/apply from untrusted clients.
Deploy an egress firewall rule set that prevents the LocalAI container or host from reaching internal management networks and cloud metadata endpoints.
Run LocalAI as a non-privileged user inside a container with a read-only root filesystem and minimal mounted volumes to reduce the scope of local file disclosure.

bash

# Example: upgrade LocalAI container image to a patched release
docker pull quay.io/go-skynet/local-ai:v2.17.0
docker stop localai && docker rm localai
docker run -d --name localai \
  --read-only \
  --tmpfs /tmp \
  -v /opt/localai/models:/models:ro \
  -p 127.0.0.1:8080:8080 \
  quay.io/go-skynet/local-ai:v2.17.0