CVE-2026-63764

Analyzed Analyzed - Analysis Complete

lmdeploy OpenAI API Server-Side Request Forgery

Publication date: 2026-07-21

Last updated on: 2026-08-05

Assigner: VulnCheck

Description

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-05

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-63764

Affected Vendors & Products

Vendor	Product	Version / Range
internlm	lmdeploy	to 0.14.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a server-side request forgery (SSRF) vulnerability in lmdeploy's OpenAI-compatible API server. It allows unauthenticated attackers to access internal services and cloud metadata endpoints by sending a crafted image_url in a POST request to the chat completions endpoint. The attacker controls a server that responds with an HTTP 302 redirect to internal addresses like loopback or instance-metadata endpoints. The vulnerability bypasses URL safety checks because redirects are followed without re-validating each hop.

Detection Guidance

To detect this SSRF vulnerability in lmdeploy's OpenAI-compatible API server, monitor network traffic for POST requests to the chat completions endpoint with image_url parameters. Check for HTTP 302 redirects from external URLs to internal addresses like loopback or cloud metadata endpoints. Inspect server logs for unusual outbound connections to internal services.

Impact Analysis

An attacker could exploit this to access sensitive internal services or cloud metadata, potentially exposing confidential data, internal network details, or cloud credentials. This could lead to further attacks, data breaches, or unauthorized access to systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Immediately disable or restrict access to the chat completions endpoint if not required. Implement strict URL validation for image_url parameters to block internal or suspicious domains. Configure network firewalls to prevent outbound connections to internal services from the API server. Update lmdeploy to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-63764. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70