LMDeploy SSRF Was Exploited Within Hours as LiteLLM Proxy Disclosed RCE Chain

Attackers began exploiting CVE-2026-33626 in LMDeploy less than 13 hours after public disclosure, using a server-side request forgery flaw in vision-language request handling to make inference servers fetch attacker-controlled and internal URLs. Sysdig said the bug affects LMDeploy 0.12.0 and earlier with vision-language support, where image_url input is not properly restricted, and observed an eight-minute attack against its honeypot that probed AWS instance metadata, localhost services, an unauthenticated administrative endpoint, and an out-of-band callback domain. The activity included scans of loopback ports associated with Redis, MySQL, and HTTP services, underscoring the risk of exposing AI inference infrastructure to internal network discovery and cloud credential theft.

The disclosures also highlighted broader weaknesses in LLM-serving platforms. LiteLLM published three advisories for LiteLLM Proxy that researchers said can be chained to achieve remote code execution, including an unauthenticated SQL injection (GHSA-r75f-5x8p-qvmc), a server-side template injection flaw, and an authenticated command-execution issue in MCP stdio test endpoints. The affected LiteLLM range is 1.81.16 through 1.83.6, with fixes available in 1.83.7-stable and later, while LMDeploy users were urged to upgrade to v0.12.3+, enforce IMDSv2, restrict egress, rotate IAM credentials, and monitor inference hosts for requests to metadata, loopback, and private-network addresses.