CVE-2026-63764: LMDeploy SSRF Vulnerability

CVE-2026-63764 Overview

CVE-2026-63764 is a server-side request forgery (SSRF) vulnerability in LMDeploy through version 0.14.0. The flaw resides in the _load_http_url function inside the connection.py media handler. The private-IP guard validates only the original URL and fails to re-validate hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint that points to an attacker-controlled host. That host returns a redirect to a private IP or cloud-metadata endpoint, and the server follows it, exposing internal service content through the model pipeline. The issue is fixed in commit 03c3130 and tracked as [CWE-918].

Critical Impact
Unauthenticated attackers can pivot LMDeploy inference servers to reach internal services and cloud metadata endpoints such as 169.254.169.254, exposing credentials and internal APIs.

Affected Products

InternLM LMDeploy versions through 0.14.0
LMDeploy chat completions endpoint accepting image_url inputs
Deployments prior to commit 03c313006d17cc3feae86b633c44206a997c44db

Discovery Timeline

2026-07-21 - CVE-2026-63764 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63764

Vulnerability Analysis

LMDeploy exposes an OpenAI-compatible chat completions API that accepts multimodal inputs, including remote image_url values. The media loader fetches these URLs server-side to build the prompt payload. The _load_http_url function in connection.py inspects the submitted URL and blocks private or loopback destinations before issuing the HTTP request. That validation is executed once, against the initial URL only.

When the remote host responds with a 3xx redirect, the underlying HTTP client transparently follows the Location header. The redirect target is never re-checked against the private-IP guard. An attacker hosts a public endpoint that returns HTTP/1.1 302 Found with a Location header pointing at an internal address. The server dutifully retrieves the redirected resource and passes the response body into the model pipeline, which can echo the content back to the caller.

Root Cause

The root cause is incomplete URL validation across the redirect chain. Security decisions are made only on the originally submitted URL, and no per-hop revalidation is applied to intermediate Location headers before the client dispatches a new request.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker submits a JSON body to the chat completions endpoint containing an image_url field pointing to an attacker-controlled domain. That domain issues a redirect to http://169.254.169.254/latest/meta-data/ on AWS, http://metadata.google.internal/ on GCP, or any internal service reachable from the inference host. The LMDeploy process retrieves the target and surfaces the data through the multimodal model response.

python

# Security patch in lmdeploy/api.py - fix: restrict remote media domains (#4734)
              max_log_len: int | None = None,
              trust_remote_code: bool = False,
              speculative_config: SpeculativeConfig | None = None,
+             allowed_media_domains: list[str] | None = None,
              **kwargs):
     """Create a pipeline for inference.

Source: GitHub Commit 03c3130

python

# Security patch in lmdeploy/cli/serve.py - fix: restrict remote media domains (#4734)
                             'engine\\u2019s tasks once the maximum number of concurrent requests is '
                             'reached, regardless of any additional requests sent by clients '
                             'concurrently during that time. Default to None.')
+        parser.add_argument('--allowed-media-domains',
+                            nargs='+',
+                            type=str,
+                            default=None,
+                            help='Exact hostnames allowed for HTTP(S) media URLs.')
         # common args
         ArgumentHelper.backend(parser)
         ArgumentHelper.log_level(parser)

Source: GitHub Commit 03c3130

The patch introduces an --allowed-media-domains allowlist so operators explicitly declare which external hostnames may serve media, removing implicit trust in arbitrary redirect targets.

Detection Methods for CVE-2026-63764

Indicators of Compromise

Outbound HTTP requests from LMDeploy processes to link-local addresses 169.254.169.254 or metadata.google.internal.
Chat completion requests containing image_url values pointing to unfamiliar external domains followed by internal traffic bursts.
LMDeploy responses that echo strings resembling AWS IAM credentials, GCP access tokens, or internal service JSON.

Detection Strategies

Inspect reverse proxy or WAF logs for /v1/chat/completions requests containing image_url fields, and correlate with egress destinations observed within the following seconds.
Enable HTTP client debug logging in LMDeploy to record redirect chains, then alert when a redirect resolves to RFC1918 or link-local ranges.
Baseline expected external image hosts for the deployment and flag any first-seen domain used as an image_url source.

Monitoring Recommendations

Monitor process-level network telemetry for the LMDeploy service and alert on connections to 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
Track anomalous response sizes and content types returned from the chat completions endpoint that deviate from typical model output.
Forward LMDeploy application logs and egress firewall logs to a centralized data lake for correlation across request identifiers and destination IPs.

How to Mitigate CVE-2026-63764

Immediate Actions Required

Upgrade LMDeploy to a build that includes commit 03c313006d17cc3feae86b633c44206a997c44db or later.
Launch the server with --allowed-media-domains set to the exact hostnames required by your workloads.
Restrict egress from inference hosts so that the LMDeploy process cannot reach cloud metadata services or internal management networks.

Patch Information

The fix is delivered in GitHub PR #4734 and merged as commit 03c3130. See the VulnCheck Security Advisory and GitHub Issue #4761 for background. The patch adds an explicit allowed_media_domains allowlist so the media loader rejects hosts that are not pre-authorized, closing the redirect bypass.

Workarounds

Place LMDeploy behind an egress proxy configured to deny requests to RFC1918, link-local, and metadata address ranges.
Disable multimodal image_url inputs at the API gateway if remote media is not required for the deployment.
Terminate HTTP redirects at a forward proxy that revalidates each Location header against a private-IP denylist before forwarding.

bash

# Configuration example: launch LMDeploy with an explicit media domain allowlist
lmdeploy serve api_server \
  /path/to/model \
  --server-name 0.0.0.0 \
  --server-port 23333 \
  --allowed-media-domains images.example.com cdn.example.net