Critical SSRF in LMDeploy API Server Exposes Internal Services via Redirect Bypass

InternLM's LMDeploy OpenAI-compatible API server is affected by CVE-2026-63764, a critical server-side request forgery flaw that lets unauthenticated attackers reach internal services by abusing image fetching in the /v1/chat/completions endpoint. The bug stems from validating only the initial image_url host and then following HTTP 302 redirects without re-checking whether subsequent destinations resolve to private or link-local addresses. As a result, an attacker can supply a public URL that redirects the server to targets such as 127.0.0.1 or the cloud metadata address 169.254.169.254, potentially exposing internal-only applications and cloud IAM credentials.

The vulnerability is tracked as CWE-918 and has been rated CVSS 9.2; one affected build identified in public reporting is LMDeploy git version 648df3b, while broader reporting says versions through 0.14.0 are impacted. A patch was merged to the main branch in PR #4734, but public reporting says no tagged release includes the fix yet. The issue was reportedly disclosed after a 36-day period without maintainer response following an initial report by researcher George Chen, increasing urgency for organizations running LMDeploy to review exposure and apply the upstream fix as soon as a release becomes available.