Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs

Fix availableCritical · CVSS 9.2EPSS 0.48%

Published Jul 7, 2026 · updated Oct 2, 2026

What to do

  1. Upgrade to a fixed version: github.com/mudler/LocalAI 1.40.1-0.20260703213242-2cbb3c96b34d.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/mudler/LocalAI

Vulnerable versions
< 1.40.1-0.20260703213242-2cbb3c96b34d
Fixed in
1.40.1-0.20260703213242-2cbb3c96b34d

Check your project: go list -m all | grep github.com/mudler/LocalAI

Sources

CWE-918 Server-Side Request Forgery (SSRF)

← All critical vulnerabilities