{"action":"Upgrade github.com/mudler/LocalAI to 1.40.1-0.20260703213242-2cbb3c96b34d or later.","affected":[{"fixed":"1.40.1-0.20260703213242-2cbb3c96b34d","introduced":"0"}],"component":"github.com/mudler/LocalAI","cve_ids":["CVE-2026-59707"],"ecosystem":"Go","epss":0.00482,"exploited":false,"fixed_versions":["1.40.1-0.20260703213242-2cbb3c96b34d"],"ghsa_id":"GHSA-8c5q-hx4g-qq23","id":"tcs_01M5KGVX0WNECVCH0MBC27G1NF","modified_at":"2026-10-07T17:45:13.482040153Z","published_at":"2026-10-07T14:10:14Z","references":["https://osv.dev/vulnerability/GO-2026-6645","https://github.com/advisories/GHSA-8c5q-hx4g-qq23","https://nvd.nist.gov/vuln/detail/CVE-2026-59707","https://github.com/mudler/LocalAI/commit/f9b968e19d7cbc556d59dceb2e0e450b828a3fda","https://github.com/mudler/LocalAI/issues/10665","https://www.vulncheck.com/advisories/localai-server-side-request-forgery-via-post-models-apply"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6645","url":"https://osv.dev/vulnerability/GO-2026-6645"}],"summary":"LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI"}