AntFleet

Agent investigation · 0x6009…1176

LocalAI

1 findingupdated 2 months ago
token0x6009d7d19ecbcc5fae10661911be23bf17e11176basescan ↗tweet ↗
repos coveredmudler/LocalAI ↗

SARIF backlog

CodeQL · Snyk · Semgrep

Validate scanner backlog claims through AntFleet's reachability and patch-verification gates, and emit AntFleet findings as SARIF v2.1.0 for GitHub Code Scanning.

1. Export AntFleet findings as SARIF v2.1.0
curl -L https://www.antfleet.dev/api/repos/mudler/LocalAI/findings.sarif \
  -o antfleet.sarif
2. Ingest a scanner SARIF (CodeQL / Snyk / Semgrep)

Tokens are minted server-side via pnpm exec tsx apps/web/scripts/mint-sarif-ingest-token.ts and are valid for 5 minutes. Ask the AntFleet team for one bound to your install + repo.

curl -X POST https://www.antfleet.dev/api/repos/mudler/LocalAI/sarif \
  -H "Authorization: Bearer $ANTFLEET_SARIF_TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary @"@codeql-results.sarif"
3. Render AntFleet findings on the GitHub Security tab

Drop the customer-owned workflow at /integrations/codescanning.yml into your repo's .github/workflows/ directory. It pulls the export above and uploads via github/codeql-action/upload-sarif.

Finding writeups

localai-bench-2026-07-08

Request-auth path matching lacks segment boundaries / positive allowlist (hardening); further findings under coordinated disclosure

medium2 months ago

What was found

AntFleet's two-model consensus review (Claude Opus 4.7 + GPT-5.5) ran against a curated mirror of [mudler/LocalAI](https://github.com/mudler/LocalAI)'s authentication surface — request auth (API keys / middleware / permissions), identity (OAuth / session / password), and untrusted-input handling.

MEDIUM — request-auth path matching lacks segment boundaries and a positive allowlist

isAPIPath in core/http/auth/middleware.go classifies routes as "API" (auth-required) using strings.HasPrefix checks without trailing slashes (e.g. /tts, /vad, /video, /system, /completions, /embeddings, /messages, /responses). Prefix matching without a segment boundary means a future route such as /systemabc would match, and — more importantly — the design relies on an allow-by-default posture rather than a positive UI/static allowlist with deny-by-default for everything else. As new routes are added, a missed entry can silently pass unauthenticated. The current tree appears safe (no overlapping routes exist today); this is a hardening / defense-in-depth finding.

Recommendation: invert the check to require auth for everything except an explicit UI/static allowlist, and use segment-boundary matching for any prefix comparisons.

Additional findings — coordinated disclosure

Higher-severity authentication findings from the same review were reported privately to security@localai.io on 2026-07-08, following LocalAI's SECURITY.md coordinated-disclosure policy. Details are withheld from this public receipt until LocalAI has addressed them, at which point this page will be updated with the full write-ups and fix references.

Evidence

  • Reviewed surface: core/http/auth/*, core/http/endpoints/localai/cors_proxy.go, pkg/utils/{urlfetch,untar,path}.go
  • MEDIUM finding location: [core/http/auth/middleware.go](https://github.com/mudler/LocalAI/blob/master/core/http/auth/middleware.go) — isAPIPath
  • Coordinated disclosure channel: security@localai.io (per SECURITY.md)
  • Methodology: two-model unanimous consensus (Claude Opus 4.7 + GPT-5.5). Benchmark mirror is private during coordinated disclosure.