A critical server-side request forgery flaw in InternLM's lmdeploy inference server allows unauthenticated attackers to pivot into internal services and cloud metadata endpoints via a crafted image URL and an HTTP redirect.
What Is It
CVE-2026-63764 is a server-side request forgery (SSRF) vulnerability (CWE-918) in lmdeploy's OpenAI-compatible API server. An unauthenticated attacker sends a POST request to the chat completions endpoint containing an image_url that points to an attacker-controlled server. That server responds with an HTTP 302 redirect to an internal address; such as a loopback or instance-metadata endpoint. Because lmdeploy follows redirects without re-validating each hop through its URL safety guard, the redirect bypasses the initial URL safety check and the request reaches the internal target.
Why It Matters
The flaw carries a CVSS 3.1 base score of 9.3 (CRITICAL), with a CVSS 4.0 score of 9.2. It requires no authentication, no privileges, and no user interaction, and is exploitable over the network at low attack complexity. The CVSS scope is marked Changed, reflecting the potential to reach internal services and cloud metadata endpoints beyond the vulnerable component. Access to instance-metadata endpoints is a common path to harvesting cloud credentials.
What's Vulnerable
- Vendor: InternLM
- Product: lmdeploy (OpenAI-compatible API server)
- Affected version: git revision
648df3b
The exposed attack surface is the chat completions endpoint's handling of the image_url parameter during vision image fetch.
Patch Status
The supplied source material does not include a CISA KEV entry for this CVE, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline. The NVD record lists no fixed version and no CPEs; its vulnerability status is "Received." Refer to the vendor's GitHub repository and the linked issue for remediation guidance.
Sources
- NVD, CVE-2026-63764
- VulnCheck Advisory: lmdeploy SSRF via HTTP redirect bypass of private IP guard
- InternLM/lmdeploy repository: github.com/InternLM/lmdeploy
- lmdeploy issue #4761: github.com/InternLM/lmdeploy/issues/4761