CVE-2026-63764

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-63764
LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/InternLM/lmdeploy/commit/03c313006d17cc3feae86b633c44206a997c44db
https://github.com/InternLM/lmdeploy/issues/4761
https://github.com/InternLM/lmdeploy/pull/4734
https://www.vulncheck.com/advisories/lmdeploy-server-side-request-forgery-via-http-redirect-bypass
https://github.com/InternLM/lmdeploy/issues/4761
Configurations

No configuration.

History

23 Jul 2026, 18:17

Type Values Removed Values Added
References
  • {'url': 'https://github.com/InternLM/lmdeploy', 'source': 'disclosure@vulncheck.com'}
  • {'url': 'https://www.vulncheck.com/advisories/lmdeploy-server-side-request-forgery-via-http-redirect-bypass-of-private-ip-guard-in-vision-image-fetch', 'source': 'disclosure@vulncheck.com'}
  • () https://github.com/InternLM/lmdeploy/commit/03c313006d17cc3feae86b633c44206a997c44db -
  • () https://github.com/InternLM/lmdeploy/pull/4734 -
  • () https://www.vulncheck.com/advisories/lmdeploy-server-side-request-forgery-via-http-redirect-bypass -
CVSS v2 : unknown
v3 : 9.3 		v2 : unknown
v3 : 8.6
Summary (en) lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted image_url that redirects to internal targets. Attackers can send a POST request to the chat completions endpoint with an image_url pointing to an attacker-controlled server that responds with an HTTP 302 redirect to internal addresses such as loopback or instance-metadata endpoints, bypassing the initial URL safety check because redirects are followed without re-validating each hop through the safety guard. (en) LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.

23 Jul 2026, 15:17

Type Values Removed Values Added
References () https://github.com/InternLM/lmdeploy/issues/4761 - () https://github.com/InternLM/lmdeploy/issues/4761 -

21 Jul 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-07-21 21:16

Updated : 2026-07-23 18:17

NVD link : CVE-2026-63764

Mitre link : CVE-2026-63764

CVE.ORG link : CVE-2026-63764

JSON object : View

Products Affected

No product.

CWE
CWE-918

Server-Side Request Forgery (SSRF)