CVE-2026-63764

Received Received - Intake

lmdeploy OpenAI API Server-Side Request Forgery

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulnCheck

Description

lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted image_url that redirects to internal targets. Attackers can send a POST request to the chat completions endpoint with an image_url pointing to an attacker-controlled server that responds with an HTTP 302 redirect to internal addresses such as loopback or instance-metadata endpoints, bypassing the initial URL safety check because redirects are followed without re-validating each hop through the safety guard.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-63764

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a server-side request forgery (SSRF) vulnerability in lmdeploy's OpenAI-compatible API server. It allows unauthenticated attackers to access internal services and cloud metadata endpoints by sending a crafted image_url in a POST request to the chat completions endpoint. The attacker controls a server that responds with an HTTP 302 redirect to internal addresses like loopback or instance-metadata endpoints. The vulnerability bypasses URL safety checks because redirects are followed without re-validating each hop.

Detection Guidance

To detect this SSRF vulnerability in lmdeploy's OpenAI-compatible API server, monitor network traffic for POST requests to the chat completions endpoint with image_url parameters. Check for HTTP 302 redirects from external URLs to internal addresses like loopback or cloud metadata endpoints. Inspect server logs for unusual outbound connections to internal services.

Impact Analysis

An attacker could exploit this to access sensitive internal services or cloud metadata, potentially exposing confidential data, internal network details, or cloud credentials. This could lead to further attacks, data breaches, or unauthorized access to systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Immediately disable or restrict access to the chat completions endpoint if not required. Implement strict URL validation for image_url parameters to block internal or suspicious domains. Configure network firewalls to prevent outbound connections to internal services from the API server. Update lmdeploy to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-63764. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70