CVE-2026-114493

HighCVSS 8.6/10Last modified Oct 22, 2026

Description

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 21, 2026
Last modified
Oct 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-11458.8A flaw has been found in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function js_typed_array_constructor_ta of thCVE-2026-114507.3A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the compCVE-2026-1145016.3Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports fCVE-2026-1145086.5Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can tCVE-2026-1145099.2Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not rejCVE-2026-114517.3A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol CVE-2026-1145107.1Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, anCVE-2026-1145156.5OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. PriorCVE-2026-1145198.6Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to readCVE-2026-114527.3A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the compoCVE-2026-114536.3A vulnerability was found in Tiobon Employee Self-Service System up to 7.2. Affected by this vulnerability is an unknown functionality of thCVE-2026-114546.5The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ve
CVE-2026-114493: High severity, CVSS 8.6 | Vulnix