CVE-2026-5000 identifies a missing authentication vulnerability in the PromtEngineer localGPT product, specifically within the LocalGPTHandler function of the backend/server.py API endpoint. The vulnerability stems from improper handling of the BaseHTTPRequestHandler argument, which allows attackers to bypass authentication controls entirely. Because localGPT uses a rolling release model, exact affected versions are difficult to pinpoint, but the vulnerability exists up to the commit hash 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The flaw enables remote attackers to send crafted HTTP requests directly to the API endpoint and gain unauthorized access without any authentication, privilege, or user interaction. This can lead to unauthorized data access, manipulation, or control over the localGPT service. The vendor has not issued patches or responded to disclosure efforts, increasing the risk window. The CVSS 4.0 score of 6.9 reflects a network attack vector with low complexity and no required privileges or user interaction, but with limited scope and impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild yet, but the vulnerability presents a clear risk for exposed deployments of localGPT, especially in environments where the API endpoint is reachable over untrusted networks.

The vulnerability allows remote attackers to bypass authentication and access the localGPT API endpoint, potentially exposing sensitive data processed or stored by the service. Unauthorized access could lead to data leakage, unauthorized command execution, or manipulation of the AI model’s behavior. For organizations using localGPT in production or research environments, this could compromise confidentiality and integrity of AI-driven workflows. Since the vulnerability requires no privileges or user interaction, any exposed instance is at risk of compromise. The rolling release nature complicates patching and version tracking, increasing the likelihood of vulnerable deployments. Although no availability impact is explicitly described, unauthorized access could be leveraged to disrupt service or degrade performance. The lack of vendor response and patches prolongs exposure, increasing risk for organizations worldwide that rely on localGPT for AI processing, especially those with internet-facing deployments or insufficient network segmentation.

1. Immediately restrict network access to the localGPT API endpoint using firewall rules or network segmentation to limit exposure to trusted hosts only. 2. Implement an authentication proxy or wrapper around the LocalGPTHandler API to enforce strong authentication and authorization controls until an official patch is available. 3. Monitor network traffic and API logs for anomalous or unauthorized access attempts targeting the localGPT API endpoint. 4. Regularly update localGPT to the latest commits or releases once the vendor addresses the vulnerability. 5. Consider deploying localGPT instances within isolated environments or VPNs to reduce exposure to untrusted networks. 6. If feasible, review and modify the backend/server.py code to add authentication checks manually as an interim fix. 7. Educate development and operations teams about the vulnerability and enforce strict access controls on AI infrastructure. 8. Engage with the vendor or community to encourage timely patch releases and share threat intelligence related to this vulnerability.