NVD HIGH: CVE-2026-59707 — LocalAI contains an unauthenticated server-side request forgery vulnerability in...

Tuesday, July 7, 2026 at 09:17 PM UTC·Source: NIST NVD

Updated: Tuesday, July 7, 2026 at 10:00 PM UTC

Executive Summary

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges w

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-59707

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Jul 7, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

NatWest Boxed and Mettle CTO Wayne Freeman leaves

The chief technology officer of NatWest's Boxed Banking-as-a-Service unit and its Mettle digital account for UK small businesses has stepped down.

59m agoFinextra

MEDIUMVulnerabilityNEW

Italian fintech Satispay partners Mastercard for debit card launch

Italian fintech unicorn Satispay has taken another step towards building out its "superapp" by joining forces with Mastercard to launch debit cards and adding the ability to invest in stocks and ETFs.

59m agoFinextra

CRITICALVulnerability

NVD CRITICAL: CVE-2026-59705 — mem0's openmemory/api component contains an unauthenticated access vulnerability...

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints wit

CVE-2026-59705

1h agoNIST NVD