What is the CVSS score of CVE-2026-33626?

CVE-2026-33626 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Lmdeploy are affected by CVE-2026-33626?

InternLM LMDeploy versions prior to 0.12.3 contain a critical Server-Side Request Forgery vulnerability in the vision-language module that enables remote attackers to access cloud metadata services…. A patch is available.

Is there a public PoC exploit available for CVE-2026-33626?

Yes, a public proof-of-concept exploit is available for CVE-2026-33626. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-33626?

Within 24 hours: inventory all InternLM LMDeploy deployments and identify running versions below 0.12.3; isolate affected instances from production if version cannot be confirmed. Within 7 days: upgrade LMDeploy to version 0.12.3 or later across all environments; validate the upgrade in staging first. Within 30 days: conduct network segmentation audit to restrict LMDeploy instances from accessing cloud metadata endpoints (169.254.169.254, equivalent services) and implement egress filtering to block internal network traversal.

Lmdeploy CVE-2026-33626

EUVD-2026-23970 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-20 GitHub_M

GHSA-6w67-hwm5-92mq

SSRF Lmdeploy

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

PoC Detected

Apr 23, 2026 - 13:39 vuln.today

Public exploit code

Patch released

Apr 23, 2026 - 13:39 nvd

Patch available

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Patch available

Apr 20, 2026 - 22:31 EUVD

Analysis Generated

Apr 20, 2026 - 21:44 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 21:15 euvd

EUVD-2026-23970

Analysis Generated

Apr 20, 2026 - 21:15 vuln.today

CVE Published

Apr 20, 2026 - 20:29 nvd

HIGH 7.5

DescriptionGitHub Advisory

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.

Articles & Coverage 1

webflow.sysdig.com CVE-2026-33626: LMDeploy SSRF Vulnerability Exploited in 12 Hours Apr 22, 2026

AnalysisAI

Server-Side Request Forgery (SSRF) in InternLM LMDeploy's vision-language module allows remote unauthenticated attackers to access cloud metadata services, internal networks, and sensitive resources through unvalidated URL fetching in the load_image() function. Affects all versions prior to 0.12.3. EPSS score not available; no public exploit identified at time of analysis. Patch released in version 0.12.3.

Technical ContextAI

LMDeploy is InternLM's toolkit for compressing, deploying, and serving large language models. The vulnerability resides in the vision-language (VL) module's image loading functionality (lmdeploy/vl/utils.py). The load_image() function accepts arbitrary URLs for image processing without implementing IP address validation or allow-listing. This is a classic CWE-918 (Server-Side Request Forgery) implementation flaw where user-controlled input directly drives server-side HTTP requests. In ML deployment contexts, vision-language models often process images from URLs during inference, making this function a critical trust boundary. The lack of validation against private IP ranges (RFC 1918), localhost, link-local addresses, and cloud metadata endpoints (169.254.169.254) enables attackers to leverage the LMDeploy server as a proxy to access resources that should be network-isolated from external users.

RemediationAI

Upgrade to InternLM LMDeploy version 0.12.3 or later immediately, as confirmed by the official release at https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3. The patch implemented in commit 71d64a339edb901e9005358e0633fbbab367d626 (https://github.com/InternLM/lmdeploy/commit/71d64a339edb901e9005358e0633fbbab367d626) adds IP address validation to the load_image() function. For environments unable to upgrade immediately, implement network-level egress filtering to block LMDeploy server access to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8), link-local addresses (169.254.0.0/16), and any internal network segments. This compensating control reduces but does not eliminate risk, as attackers may still reach allowed external resources or exploit DNS rebinding techniques. Additionally, restrict the vision-language API endpoints to authenticated users only using reverse proxy authentication (e.g., nginx with basic auth, OAuth2 proxy) as defense-in-depth, though this trades off usability for API consumers. Review cloud security group rules to ensure LMDeploy instances cannot directly access metadata services if compensating controls are used.