External risk intelligence

LocalAI SSRF via Gallery Config URL Validation Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-114493

LocalAI is designed as a self-hosted API service for AI models, frequently deployed as an internet-facing web API or edge service to allow remote application access. The vulnerability resides in an API endpoint (/models/apply) used for managing configurations, which is often exposed in environments where the service provides public or externally accessible model hosting capabilities.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in LocalAI could allow an attacker to trick the system into revealing sensitive information by submitting a malicious URL. The issue lies in how the application handles gallery configuration URLs, potentially leading to unauthorized access to internal or cloud metadata. Confirming if your LocalAI instances are affected is the primary concern.

Systems may expose internal data to attackers.
Attackers can bypass security controls to access sensitive information.
Confirm relevance and exposure to protect internal systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a crafted configuration URL to the `/models/apply` endpoint. This URL can be designed to redirect to internal network addresses or cloud provider metadata endpoints. The server, attempting to process this URL, will retrieve and return the content from the redirected location, potentially exposing sensitive internal information or credentials.

Requires an exposed API endpoint.
Triggers via a malicious gallery config URL.
Risk of sensitive data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to trick the LocalAI server into making requests to internal network resources or cloud metadata services. When supported by the advisory, this could expose sensitive information that the server has access to, such as cloud credentials or internal system details.

Internal network or cloud metadata data.
Server sends requests to attacker-controlled URLs.
Exposure of sensitive system or cloud credentials.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a typical deployment, the platform or infrastructure team responsible for LocalAI's underlying environment would likely lead the response, in coordination with the application owners and the security team. The initial practical step is to identify all LocalAI instances, assess their exposure and criticality, and determine the accountable owner before planning remediation.

Platform and application owners should lead.
Verify all LocalAI instance exposures.
Plan risk-based remediation activities.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LocalAI?

LocalAI is an open-source, self-hosted API service designed to run large language models and other AI workloads locally. It acts as an alternative to hosted AI platforms, allowing developers to manage and deploy models within their own infrastructure. Users typically rely on it to provide model hosting capabilities to other applications, often deploying it as an API gateway or backend service.

What is the vulnerability in CVE-2026-114493?

This vulnerability is a Server-Side Request Forgery (SSRF), classified as CWE-918. It occurs because the software fails to properly validate the final destination of a URL. While the application checks the initial gallery configuration URL, it does not account for redirects. An attacker can provide a URL that redirects to internal systems or restricted cloud metadata services, tricking the server into fetching and revealing data it should not access.

How is this vulnerability triggered?

An attacker triggers the bug by sending a crafted request to the /models/apply endpoint with a malicious gallery configuration URL. The vulnerability is triggered when the server follows a redirect from that initial URL to an unauthorized location. Requests that do not involve redirection to internal or restricted cloud resources do not trigger the underlying flaw, as the server only retrieves content from the final destination reached after following the redirect.

How does Halo Surface Signal categorize this risk?

Halo Surface Signal identifies this as a 'Likely' concern because LocalAI is commonly deployed as an internet-facing web API to support remote application access. If your service is exposed to the internet, it is more reachable by outside actors. Because the vulnerability allows the server to probe internal or cloud metadata, any instance with network reachability to sensitive internal services is at higher risk of data exposure.

What should I do if I run LocalAI?

Begin by identifying all running instances of LocalAI within your environment to determine which versions are active. Assess whether these instances are accessible from the internet or other untrusted networks. Coordinate with your platform and application owners to evaluate the criticality of each instance, then prioritize identifying an upgrade path or configuration change to address the validation bypass in the gallery configuration processing.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.