Loading vulnerability…
SSRF in LMDeploy OpenAI-compatible API Server image_url Redirect Handling
CVE-2026-63764 is a server-side request forgery vulnerability in InternLM LMDeploy's OpenAI-compatible API server affecting versions through 0.14.0. The flaw is in the server-side media fetching logic used for vision workflows, where a supplied image_url is validated only at the initial destination and then fetched with automatic HTTP redirect following enabled. Because subsequent redirect targets are not re-validated by the URL safety guard, an attacker can provide a public, attacker-controlled URL that passes the initial check and then responds with an HTTP redirect to an internal target such as loopback or a cloud instance metadata service. This turns the inference server into a proxy for reaching otherwise inaccessible internal resources.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthenticated remote attackers to make the LMDeploy server issue requests to internal network destinations and cloud metadata services. This can expose internal-only services, sensitive metadata, and cloud instance credentials or IAM tokens. Depending on the environment, the vulnerability can also facilitate internal network reconnaissance, pivoting, lateral movement, and follow-on privilege escalation through credential theft or access to trusted internal services.
If you can’t patch tonight, do this now.
Until a patched version is deployed, restrict or disable server-side fetching of untrusted remote URLs in the OpenAI-compatible vision workflow. Enforce strict egress filtering from the LMDeploy service to block outbound access to loopback, link-local, private, and other non-globally-routable address ranges, including cloud metadata endpoints. Limit exposure of the affected API to trusted callers only, and place the service in a network segment that cannot reach sensitive internal control-plane or metadata services.
Patch, then assume compromise.
Upgrade to a vendor-fixed LMDeploy release that disables unsafe automatic redirect handling for image_url fetching or re-validates every redirect hop against the SSRF safety policy before issuing the next request. If no tagged release containing the fix is yet available, deploy a build that includes the upstream patch referenced as PR #4734, which stops automatic redirect following and enforces validation on redirect targets.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.