Loading story…
InternLM's LMDeploy OpenAI-compatible API server is affected by CVE-2026-63764, a critical server-side request forgery flaw that lets unauthenticated attackers reach internal services by abusing image fetching in the /v1/chat/completions endpoint. The bug stems from validating only the initial image_url host and then following HTTP 302 redirects without re-checking whether subsequent destinations resolve to private or link-local addresses. As a result, an attacker can supply a public URL that redirects the server to targets such as 127.0.0.1 or the cloud metadata address 169.254.169.254, potentially exposing internal-only applications and cloud IAM credentials.
The vulnerability is tracked as CWE-918 and has been rated CVSS 9.2; one affected build identified in public reporting is LMDeploy git version 648df3b, while broader reporting says versions through 0.14.0 are impacted. A patch was merged to the main branch in PR #4734, but public reporting says no tagged release includes the fix yet. The issue was reportedly disclosed after a 36-day period without maintainer response following an initial report by researcher George Chen, increasing urgency for organizations running LMDeploy to review exposure and apply the upstream fix as soon as a release becomes available.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Public reporting described CVE-2026-63764 as a critical SSRF in LMDeploy's OpenAI-compatible API server through version 0.14.0, exploitable via crafted image_url redirects to internal services or cloud metadata endpoints. The disclosure also stated that the issue became public after 36 days of maintainer silence.
The CVE record for CVE-2026-63764 was newly received by disclosure@vulncheck.com. The record describes an SSRF issue in InternLM's lmdeploy server caused by following redirects without re-validating private-IP protections.
A fix for the SSRF vulnerability was merged into LMDeploy's main branch in pull request #4734. The source notes that no tagged release included the patch at the time of publication.
George Chen initially reported the SSRF vulnerability in LMDeploy's OpenAI-compatible API server. The later write-up says the issue was publicly disclosed after 36 days of maintainer silence following this report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
ox.security
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers began exploiting **CVE-2026-33626** in LMDeploy less than 13 hours after public disclosure, using a server-side request forgery flaw in vision-language request handling to make inference servers fetch attacker-controlled and internal URLs. Sysdig said the bug affects LMDeploy `0.12.0` and earlier with vision-language support, where `image_url` input is not properly restricted, and observed an eight-minute attack against its honeypot that probed AWS instance metadata, localhost services, an unauthenticated administrative endpoint, and an out-of-band callback domain. The activity included scans of loopback ports associated with **Redis**, **MySQL**, and HTTP services, underscoring the risk of exposing AI inference infrastructure to internal network discovery and cloud credential theft. The disclosures also highlighted broader weaknesses in LLM-serving platforms. LiteLLM published three advisories for LiteLLM Proxy that researchers said can be chained to achieve **remote code execution**, including an unauthenticated SQL injection (`GHSA-r75f-5x8p-qvmc`), a server-side template injection flaw, and an authenticated command-execution issue in MCP stdio test endpoints. The affected LiteLLM range is `1.81.16` through `1.83.6`, with fixes available in `1.83.7-stable` and later, while LMDeploy users were urged to upgrade to `v0.12.3+`, enforce **IMDSv2**, restrict egress, rotate IAM credentials, and monitor inference hosts for requests to metadata, loopback, and private-network addresses.
Jun 29, 2026
**CVE-2026-22778** is a critical vulnerability in *vLLM* (an LLM inference/serving engine) that can enable **remote code execution (RCE)** when a server processes attacker-supplied multimodal content (e.g., a crafted video/image payload). The issue stems from vLLM returning a **PIL error** to the client when an invalid image is submitted to a multimodal endpoint, which **leaks a heap address** and dramatically weakens ASLR (reported as reducing brute-force from billions of guesses to ~8). This information disclosure can then be chained with a **heap overflow** in the **JPEG2000 decoder** within bundled **OpenCV/FFmpeg** components to hijack execution flow and run arbitrary commands on the host. Operational risk is elevated because many **default vLLM deployments** (including common `pip`/Docker installs) may be exposed without authentication, and reporting indicates exploitation may still be possible **pre-auth** even when API keys are enabled (via an “invocations” route). The vulnerability affects versions **0.8.3 through < 0.14.1** and is **fixed in vLLM 0.14.1**; remediation should prioritize upgrading to `>= 0.14.1` and reviewing exposure of multimodal endpoints, especially any internet-accessible instances.
Jul 12, 2026
**LoLLMs WEBUI** was found to contain two high-severity vulnerabilities affecting core web application functionality. The most severe issue, tracked as `CVE-2026-33340`, is an **unauthenticated server-side request forgery (SSRF)** in the `POST /api/proxy` endpoint that affects all known existing versions. An attacker can abuse the endpoint to force the server to make arbitrary `GET` requests, potentially reaching internal services, scanning local networks, and retrieving sensitive cloud metadata, including possible AWS or GCP IAM tokens. The flaw is mapped to `CWE-306` and `CWE-918`, with a `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`, and no patched version was known at publication. A second critical flaw, `CVE-2026-0562`, affects **parisneo/lollms** through an **insecure direct object reference (IDOR)** in friend request handling. In versions up to `2.2.0`, the `respond_request()` function in `backend/routers/friends.py` failed to verify that the authenticated user was part of the targeted friendship, allowing any logged-in user to accept or reject another user's friend requests via `/api/friends/requests/{friendship_id}`. The weakness, mapped to `CWE-863`, could enable unauthorized actions, privacy violations, and social engineering abuse; unlike the SSRF issue, this bug includes references to a fixing commit and a Huntr report.
Jun 29, 2026