SSRF Flaw Discovered in lmdeploy API

A newly identified security vulnerability in the lmdeploy OpenAI-compatible API server has been assigned the identifier CVE-2026-63764. The flaw centers on a Server-Side Request Forgery (SSRF) mechanism that permits unauthorized actors to probe internal infrastructure and cloud metadata services.

Redirects Bypass Security Guards

The core of the issue involves how the API processes image_url inputs. An attacker can initiate a POST request to the chat completions endpoint, providing a URL that points to a server under their control. When the lmdeploy service accesses this destination, the attacker-controlled server provides an HTTP 302 redirect.

Because the application logic fails to re-validate subsequent hops after the initial URL safety check, the service follows the redirect to sensitive internal locations. This behavior effectively sidesteps protections designed to prevent the software from interacting with internal loopback or instance-metadata endpoints.

Quantifiable Risk Metrics

• CVE Identifier: CVE-2026-63764
• CVSS 3.1 Score: 9.3 (CRITICAL)
• Publication Date: 2026-07-21T21:16:53.350

Operational Implications for Infrastructure

The technical configuration of this vulnerability suggests significant exposure for environments where the lmdeploy service is granted network-level access to internal assets. Because the vulnerability is reachable through the chat completions endpoint and does not require authentication, it allows for remote exploitation by any entity capable of communicating with the API server.

This vulnerability underscores the risks inherent in automated image-fetching processes that do not perform recursive verification of redirect chains. For organizations utilizing these API components, the potential for unauthorized access to cloud metadata or internal services remains a primary concern until the logic governing how the server follows redirects is corrected.