{"id":"GO-2026-6645","revision":"4a5d08a86f0f481e981ba955dd86bd16","records":[{"revision":"4a5d08a86f0f481e981ba955dd86bd16","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6645","aliases":["CVE-2026-59707","GHSA-8c5q-hx4g-qq23"],"title":"LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI","description":"LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI","state":0,"publishedAt":"2026-10-07T14:10:14+00:00","modifiedAt":"2026-10-07T17:45:13.4820402+00:00","affected":[{"ecosystem":"Go","name":"github.com/mudler/LocalAI","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.40.1-0.20260703213242-2cbb3c96b34d"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-8c5q-hx4g-qq23","https://nvd.nist.gov/vuln/detail/CVE-2026-59707","https://github.com/mudler/LocalAI/commit/f9b968e19d7cbc556d59dceb2e0e450b828a3fda","https://github.com/mudler/LocalAI/issues/10665","https://www.vulncheck.com/advisories/localai-server-side-request-forgery-via-post-models-apply"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6645","license":"OSV · upstream source license applies","key":"osv:GO-2026-6645","identifiers":["GO-2026-6645","CVE-2026-59707","GHSA-8c5q-hx4g-qq23"]},"retained":false,"historicalAffected":[]}],"coverage":[]}