CVE-2024-5616

A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview', without the victim's consent. The vulnerability is due to insufficient CSRF protection mechanisms on the model deletion functionality.

• CWE-352

• https://github.com/mudler/localai/commit/4e1463fec291612a59a16db60b3fd12d4c49d64bPatch
• https://huntr.com/bounties/fd753fb6-ba04-4dd8-abef-918fb97120afExploit, Third Party Advisory
• https://github.com/mudler/localai/commit/4e1463fec291612a59a16db60b3fd12d4c49d64bPatch
• https://huntr.com/bounties/fd753fb6-ba04-4dd8-abef-918fb97120afExploit, Third Party Advisory

Published

Jul 6, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-56145Craft is a flexible, user-friendly CMS for creating custom d…9.8
• CVE-2024-5615The Open Graph plugin for WordPress is vulnerable to Sensiti…5.3
• CVE-2024-56156Halo is an open source website building tool. Prior to versi…9
• CVE-2024-56157iTop is an web based IT Service Management tool. Prior to ve…6.3
• CVE-2024-56158XWiki is a generic wiki platform. It's possible to execute a…9.8
• CVE-2024-56159Astro is a web framework for content-driven websites. A bug …5.3
• CVE-2024-56161Improper signature verification in AMD CPU ROM microcode pat…7.2
• CVE-2024-56169A validation integrity issue was discovered in Fort through …5.3
• CVE-2024-56170A validation integrity issue was discovered in Fort through …5.3
• CVE-2024-56171libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-af…9.8
• CVE-2024-56173In Optimizely Configured Commerce before 5.2.2408, malicious…4.7
• CVE-2024-56174In Optimizely Configured Commerce before 5.2.2408, malicious…8.1