Critical SSRF Flaw Found in lmdeploy API

The lmdeploy OpenAI-compatible API server contains a server-side request forgery (SSRF) vulnerability, identified as CVE-2026-63764. This critical flaw, carrying a CVSS 3.1 score of 9.3, allows an unauthenticated attacker to bypass safety checks and interact with internal network resources.

What's at Risk

The vulnerability affects the lmdeploy framework's vision image processing functionality. Organizations running internet-facing instances of the lmdeploy API server are at the highest risk, as the flaw does not require authentication to execute.

By targeting this service, an attacker can potentially reach restricted internal services or cloud provider instance-metadata endpoints. These endpoints often contain sensitive configuration data, credentials, or service tokens that are intended to be accessible only by the local instance.

How the Flaw Works

SSRF vulnerabilities occur when a server fetches a remote resource without sufficiently validating the user-supplied URL. In a typical attack of this class, an adversary provides a URL to a malicious server they control. When the target application attempts to retrieve the resource, the attacker's server responds with an HTTP redirect.

If the application follows redirects without re-validating the final destination against a blocklist, it may be tricked into performing requests against internal loopback addresses or private network infrastructure. This allows the attacker to use the server as a proxy to scan internal ports, access private APIs, or extract sensitive metadata that would otherwise be shielded by a firewall.

How to Protect Your Systems

• Review the official project repository for available patches and apply updates immediately.
• Restrict network access to the lmdeploy API server by placing it behind a reverse proxy or VPN.
• Implement strict egress filtering on the server to prevent it from initiating connections to unauthorized internal IP ranges.
• Disable vision-related API features if they are not required for your specific deployment.
• Monitor server logs for suspicious outbound requests or unusual patterns of HTTP traffic to internal network addresses.

Given the critical severity of CVE-2026-63764, administrators should prioritize the assessment of their current lmdeploy deployments. Because this vulnerability allows for unauthorized access to internal infrastructure, failing to address the flaw promptly leaves sensitive cloud environments exposed to potential exploitation.