CVE-2026-114493 [HIGH] – LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in cor

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.