{"action":"Upgrade github.com/mudler/LocalAI to 1.40.1-0.20260703213242-2cbb3c96b34d or later.","affected":[{"fixed":"1.40.1-0.20260703213242-2cbb3c96b34d","introduced":"0"}],"component":"github.com/mudler/LocalAI","cve_ids":["CVE-2026-59707"],"ecosystem":"Go","epss":0.01383,"exploited":false,"fixed_versions":["1.40.1-0.20260703213242-2cbb3c96b34d"],"ghsa_id":"GHSA-8c5q-hx4g-qq23","id":"tcs_01M5KF3G8AMPXQYT11Z58X21P8","modified_at":"2026-10-07T17:55:52.810868417Z","published_at":"2026-07-07T21:31:36Z","references":["https://osv.dev/vulnerability/GHSA-8c5q-hx4g-qq23","https://nvd.nist.gov/vuln/detail/CVE-2026-59707","https://github.com/mudler/LocalAI/issues/10665","https://github.com/mudler/LocalAI/commit/f9b968e19d7cbc556d59dceb2e0e450b828a3fda","https://github.com/mudler/LocalAI","https://www.vulncheck.com/advisories/localai-server-side-request-forgery-via-post-models-apply"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-8c5q-hx4g-qq23","url":"https://osv.dev/vulnerability/GHSA-8c5q-hx4g-qq23"}],"summary":"LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs"}