Which versions of lmdeploy are affected by CVE-2026-63764?

InternLM lmdeploy's vision API server contains an unauthenticated server-side request forgery (SSRF) vulnerability enabling remote attackers to access internal resources and retrieve cloud…. A patch is available.

How to fix or mitigate CVE-2026-63764?

Within 24 hours, inventory deployments of InternLM lmdeploy by version and environment to establish attack surface. Within 7 days, apply the vendor-released patch implementing media-domain allowlist validation to block redirect-based SSRF attacks. Within 30 days, complete patch rollout across all production and staging instances, and validate through log review or internal testing that HTTP 302 redirects to internal endpoints are now blocked.

lmdeploy CVE-2026-63764

Q: What is the CVSS score of CVE-2026-63764?

CVE-2026-63764 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46412 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-21 VulnCheck

GHSA-rqhf-rg9p-w5gg

SSRF Lmdeploy Internlm

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Unauthenticated network SSRF (AV:N/AC:L/PR:N/UI:N) that pivots into other systems (S:C); reachable internal services and cloud IAM metadata make C:H, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 18:28 vuln.today

Analysis Updated

Jul 23, 2026 - 18:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 18:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 18:22 NVD

CRITICAL HIGH

CVSS changed

Jul 23, 2026 - 18:22 NVD

9.2 (CRITICAL) 7.7 (HIGH)

Analysis Generated

Jul 21, 2026 - 21:04 vuln.today

CVE Published

Jul 21, 2026 - 20:36 cve.org

CRITICAL 9.2

DescriptionCVE.org

lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted image_url that redirects to internal targets. Attackers can send a POST request to the chat completions endpoint with an image_url pointing to an attacker-controlled server that responds with an HTTP 302 redirect to internal addresses such as loopback or instance-metadata endpoints, bypassing the initial URL safety check because redirects are followed without re-validating each hop through the safety guard.

AnalysisAI

Server-side request forgery in InternLM lmdeploy's OpenAI-compatible vision API server lets unauthenticated remote attackers coerce the server into fetching internal-only resources by abusing the image_url media-fetch path. Because the URL safety check validates only the initial URL and does not re-validate targets after an HTTP 302 redirect, an attacker-hosted endpoint can redirect the fetch to loopback services or cloud instance-metadata endpoints, exposing internal services and potentially cloud credentials. No public exploit is identified at time of analysis, EPSS is low (0.28%), and a vendor fix adding a media-domain allowlist is available.

Technical ContextAI

lmdeploy is an InternLM toolkit for compressing, deploying, and serving large language and vision-language models, exposing an OpenAI-compatible HTTP API (chat/completions) that accepts multimodal inputs. When a request includes an image_url, the server's multimodal media fetcher retrieves the remote image over HTTP(S). The root cause is CWE-918 (Server-Side Request Forgery): the private-IP/safety guard evaluates the user-supplied URL once, but the underlying HTTP client transparently follows redirects and each redirected hop is not re-checked against the guard. This time-of-check/time-of-use gap lets an initially benign-looking external URL pivot, via a 302 Location header, to RFC1918/loopback addresses or cloud metadata services (e.g., 169.254.169.254). The affected component is identified by CPE cpe:2.3:a:internlm:lmdeploy (all versions prior to the fix).

RemediationAI

Upgrade to a build of lmdeploy that contains the upstream fix in pull request #4734 / commit 03c313006d17cc3feae86b633c44206a997c44db; the upstream fix is available (PR/commit) but a released patched version tag is not independently confirmed from the provided data, so verify the exact release with the vendor. The fix adds a --allowed-media-domains startup option, so operators exposing the API server to untrusted clients should launch with an explicit hostname allowlist, e.g. lmdeploy serve api_server <model_path> --allowed-media-domains example.com (matching is exact-hostname, so cdn.example.com must be listed separately). Where immediate upgrade is not possible, apply compensating controls: place the API server behind an egress firewall/proxy that blocks outbound requests to RFC1918, loopback, and link-local ranges including 169.254.169.254 (trade-off: breaks legitimate internal image fetching); enforce IMDSv2 and disable IMDSv1 with a low hop limit on cloud instances to blunt metadata theft (trade-off: requires IMDSv2-aware tooling); and require authentication or network-level restriction in front of the chat/completions endpoint so anonymous clients cannot submit image_url values (trade-off: affects legitimate unauthenticated API consumers). See the VulnCheck advisory and the repository documentation update for details.