CVE-2026-63764: LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted imageurl to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LMDeployto a version that resolves this vulnerability.Patch 03c3130 - Compensating control
Block outbound server network access from LMDeploy to private IP ranges and cloud metadata endpoints (e.g., 169.254.169.254) to limit SSRF impact even if redirect handling is flawed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63764?
The severity of CVE-2026-63764 is rated as critical with a CVSS score of 9.3.
How does CVE-2026-63764 work?
CVE-2026-63764 is a server-side request forgery vulnerability that enables attackers to access internal services by crafting specific image URLs.
What are the potential impacts of CVE-2026-63764?
The impact of CVE-2026-63764 includes unauthorized access to internal services and cloud metadata, which could lead to data breaches.
How do I fix CVE-2026-63764?
To fix CVE-2026-63764, ensure that your configuration properly validates image URLs and restricts access to internal targets.
Who is affected by CVE-2026-63764?
CVE-2026-63764 affects users of the lmdeploy's OpenAI-compatible API server, especially those utilizing the vision image fetch functionality.