Loading story…
Attackers began exploiting CVE-2026-33626 in LMDeploy less than 13 hours after public disclosure, using a server-side request forgery flaw in vision-language request handling to make inference servers fetch attacker-controlled and internal URLs. Sysdig said the bug affects LMDeploy 0.12.0 and earlier with vision-language support, where image_url input is not properly restricted, and observed an eight-minute attack against its honeypot that probed AWS instance metadata, localhost services, an unauthenticated administrative endpoint, and an out-of-band callback domain. The activity included scans of loopback ports associated with Redis, MySQL, and HTTP services, underscoring the risk of exposing AI inference infrastructure to internal network discovery and cloud credential theft.
The disclosures also highlighted broader weaknesses in LLM-serving platforms. LiteLLM published three advisories for LiteLLM Proxy that researchers said can be chained to achieve remote code execution, including an unauthenticated SQL injection (GHSA-r75f-5x8p-qvmc), a server-side template injection flaw, and an authenticated command-execution issue in MCP stdio test endpoints. The affected LiteLLM range is 1.81.16 through 1.83.6, with fixes available in 1.83.7-stable and later, while LMDeploy users were urged to upgrade to v0.12.3+, enforce IMDSv2, restrict egress, rotate IAM credentials, and monitor inference hosts for requests to metadata, loopback, and private-network addresses.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Users were advised to upgrade LiteLLM Proxy to version 1.83.7-stable or later to address the newly disclosed vulnerabilities. The disclosure noted that official container images run the proxy as root, which can increase impact on vulnerable hosts.
LiteLLM disclosed three GitHub Security Advisories covering an unauthenticated SQL injection, a server-side template injection, and an authenticated command-execution flaw in LiteLLM Proxy. The vulnerabilities affect versions 1.81.16 through 1.83.6 and can be chained to achieve remote code execution.
Following disclosure and observed exploitation, defenders were advised to remediate by upgrading LMDeploy to v0.12.3 or newer and to harden deployments with measures such as IMDSv2 enforcement, egress restrictions, credential rotation, and monitoring for suspicious internal URL access.
On April 22, 2026, Sysdig observed an attacker exploit the LMDeploy SSRF vulnerability against its honeypot about 12.5 hours after the advisory became public. The attacker probed AWS metadata, localhost services, an unauthenticated administrative endpoint, and an out-of-band callback domain during an eight-minute session.
GitHub published a security advisory on an SSRF flaw in LMDeploy affecting vision-language request handling, later tracked as CVE-2026-33626. The issue allows user-supplied image_url values to trigger requests to arbitrary internal or external URLs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcereddit.com
Open sourcerunzero.com
Open sourcewebflow.sysdig.com
Open sourcesysdig.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
InternLM's **LMDeploy** OpenAI-compatible API server is affected by **CVE-2026-63764**, a critical server-side request forgery flaw that lets unauthenticated attackers reach internal services by abusing image fetching in the `/v1/chat/completions` endpoint. The bug stems from validating only the initial `image_url` host and then following HTTP `302` redirects without re-checking whether subsequent destinations resolve to private or link-local addresses. As a result, an attacker can supply a public URL that redirects the server to targets such as `127.0.0.1` or the cloud metadata address `169.254.169.254`, potentially exposing internal-only applications and cloud IAM credentials. The vulnerability is tracked as **CWE-918** and has been rated **CVSS 9.2**; one affected build identified in public reporting is LMDeploy git version `648df3b`, while broader reporting says versions through **0.14.0** are impacted. A patch was merged to the main branch in **PR #4734**, but public reporting says no tagged release includes the fix yet. The issue was reportedly disclosed after a 36-day period without maintainer response following an initial report by researcher George Chen, increasing urgency for organizations running LMDeploy to review exposure and apply the upstream fix as soon as a release becomes available.
Jul 22, 2026
CISA added **CVE-2026-42271** to its Known Exploited Vulnerabilities catalog after evidence emerged that attackers are exploiting a command injection flaw in BerriAI **LiteLLM**. The bug affects MCP server test endpoints in self-hosted LiteLLM deployments, where crafted `stdio` parameters can trigger arbitrary command execution on the proxy host. On its own, the flaw requires a valid proxy API key, but researchers reported it is being chained with **CVE-2026-48710** in **Starlette**—a Host header validation bypass known as **BadHost**—to bypass authentication and achieve unauthenticated remote code execution. The exposed attack path affects LiteLLM versions **1.74.2 through 1.83.6** when deployed with **Starlette 1.0.0 or earlier**, and researchers rated the combined chain as effectively **critical** with a CVSS score of **10.0**. Successful compromise can let attackers run OS commands, steal model provider credentials, API keys, secrets, and environment variables, and pivot into connected AI infrastructure. BerriAI patched the issue in **LiteLLM 1.83.7** by restricting the vulnerable test endpoints to the `PROXY_ADMIN` role, while defenders are being urged to upgrade LiteLLM and Starlette, limit network access to the affected endpoints, rotate stored credentials, and review logs for suspicious Host header and subprocess activity.
Jun 29, 2026
Attackers began exploiting **CVE-2026-42208** in LiteLLM shortly after public disclosure, using a pre-authentication SQL injection flaw in the product’s `Authorization: Bearer` verification path to query the backend PostgreSQL database without logging in. The vulnerability, also tracked as `GHSA-r75f-5x8p-qvmc`, affects LiteLLM versions **1.81.16 through 1.83.6** and was fixed in **v1.83.7** after the project replaced vulnerable string interpolation with a parameterized query. Sysdig said the first observed exploitation attempt arrived **36 hours and seven minutes** after the advisory was indexed, with activity focused on enumerating high-value tables holding virtual API keys, provider credentials, verification tokens, and environment-based configuration. Researchers described the intrusion attempts as targeted rather than opportunistic, citing knowledge of Prisma-generated PostgreSQL table names and `UNION`-based column discovery; while no confirmed follow-on abuse was observed, defenders are being urged to patch exposed instances immediately, rotate all stored secrets, and review logs and billing accounts for signs of compromise.
Jun 29, 2026