CVE-2026-59707: LocalAI SSRF Vulnerability

CVE-2026-59707 Overview

CVE-2026-59707 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in LocalAI, an open-source AI model serving platform. The flaw resides in the POST /models/apply endpoint, which accepts gallery URL fields and forwards them to gallery.GetGalleryConfigFromURLWithContext without validation. Attackers can force the server to issue arbitrary HTTP GET requests to internal, private, and loopback address ranges. Partial response content leaks back to the attacker through error messages, enabling reconnaissance of internal services and metadata endpoints. The vulnerability is tracked under [CWE-918] and does not require authentication or user interaction.

Critical Impact
Unauthenticated attackers can pivot from an exposed LocalAI instance to reach internal-only services, cloud metadata APIs, and loopback endpoints, exfiltrating response fragments through error messages.

Affected Products

LocalAI (mudler/LocalAI) — versions prior to the fix in commit f9b968e
Deployments exposing the POST /models/apply endpoint without upstream network controls
Container and Kubernetes deployments of LocalAI reachable over the network

Discovery Timeline

2026-07-07 - CVE-2026-59707 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59707

Vulnerability Analysis

LocalAI exposes an HTTP API to install and apply model gallery configurations. The POST /models/apply endpoint accepts JSON parameters that include gallery URL fields describing where model metadata should be fetched. These fields are passed directly into gallery.GetGalleryConfigFromURLWithContext, which issues an outbound HTTP GET request using the value supplied by the caller.

Because the endpoint requires no authentication and performs no destination validation, the server acts as an open HTTP proxy to any address reachable from its network position. Response bodies from failed fetches are echoed back inside error messages, converting a blind SSRF into a partial-content oracle. Attackers can enumerate internal HTTP services, read cloud instance metadata, and probe loopback administrative interfaces.

Root Cause

The root cause is missing input sanitization on gallery URL fields before they are dereferenced by the model gallery fetcher. The application does not enforce an allowlist of remote hosts, does not block private and loopback ranges, and does not restrict the URL scheme. Error-handling logic further embeds partial response content in returned messages, amplifying the disclosure impact.

Attack Vector

An unauthenticated remote attacker sends a crafted JSON body to POST /models/apply containing a URL that points to an internal address such as http://127.0.0.1: targets, RFC1918 hosts, or cloud metadata endpoints. LocalAI issues the outbound request under its own network identity and returns fragments of the response through the error channel. Detailed technical analysis is available in the VulnCheck Advisory: LocalAI SSRF and GitHub Issue #10665.

Detection Methods for CVE-2026-59707

Indicators of Compromise

Inbound HTTP requests to /models/apply containing URL fields referencing 127.0.0.1, localhost, 169.254.169.254, or RFC1918 address ranges
LocalAI application logs showing outbound fetch attempts to loopback or private addresses immediately following an unauthenticated API call
Error responses returned by LocalAI that contain fragments of internal service banners, HTML, or JSON not originating from public gallery sources

Detection Strategies

Inspect reverse proxy and web application firewall logs for POST /models/apply requests whose payload URL fields resolve to internal, loopback, or link-local addresses
Correlate LocalAI process egress traffic with expected upstream gallery hosts and alert on deviations to internal subnets or cloud metadata IPs
Monitor for repeated 4xx or 5xx responses from /models/apply that carry unusually large error bodies, indicating content leak through error messages

Monitoring Recommendations

Enable request-body logging on the LocalAI ingress path with retention sufficient for incident review
Track egress connections from LocalAI hosts to 169.254.0.0/16, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16
Alert on unauthenticated access to /models/apply when the deployment is expected to be internal-only

How to Mitigate CVE-2026-59707

Immediate Actions Required

Update LocalAI to a build that includes commit f9b968e, which addresses the SSRF
Place LocalAI behind an authenticating reverse proxy and restrict /models/apply to trusted administrators
Block egress from LocalAI hosts to loopback, RFC1918, and cloud metadata address ranges at the network layer

Patch Information

The upstream project has committed a fix in GitHub Commit f9b968e. Operators should redeploy from a container image or build that includes this commit. Tracking discussion is available at GitHub Issue #10665 and in the upstream GitHub LocalAI Repository.

Workarounds

Restrict network access to the LocalAI API using firewall rules or Kubernetes NetworkPolicy so that only trusted clients can reach /models/apply
Deploy an egress proxy that enforces an allowlist of approved gallery hosts and rejects requests to private ranges
Disable the model gallery apply functionality entirely in environments where dynamic model installation is not required

bash

# Example: block LocalAI egress to internal ranges using iptables
iptables -A OUTPUT -m owner --uid-owner localai -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner localai -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner localai -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner localai -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner localai -d 192.168.0.0/16 -j REJECT