CVE-2024-7010: mudler localai Observable Timing Discrepancy
Vulnerability summary
CVE-2024-7010 is a high (CVSS 7.5) Observable Timing Discrepancy vulnerability in mudler localai. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 29-10-2024PublishedVulnerability first disclosed.
- 15-10-2025Last modifiedVulnerability information updated.
Description
mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the context of password handling, an attacker can determine valid login credentials based on the server's response time, potentially leading to unauthorized access.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.52% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Mudler2 products
- localai2.17.1
- mudler/localai≥ unspecified, < 2.21
1 vendor · 2 products