EUVD-2026-46412
GHSA-rqhf-rg9p-w5gg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SSRF (AV:N/AC:L/PR:N/UI:N) that pivots into other systems (S:C); reachable internal services and cloud IAM metadata make C:H, with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted image_url that redirects to internal targets. Attackers can send a POST request to the chat completions endpoint with an image_url pointing to an attacker-controlled server that responds with an HTTP 302 redirect to internal addresses such as loopback or instance-metadata endpoints, bypassing the initial URL safety check because redirects are followed without re-validating each hop through the safety guard.
AnalysisAI
Server-side request forgery in InternLM lmdeploy's OpenAI-compatible vision API server lets unauthenticated remote attackers coerce the server into fetching internal-only resources by abusing the image_url media-fetch path. Because the URL safety check validates only the initial URL and does not re-validate targets after an HTTP 302 redirect, an attacker-hosted endpoint can redirect the fetch to loopback services or cloud instance-metadata endpoints, exposing internal services and potentially cloud credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the lmdeploy OpenAI-compatible API server to be network-reachable by the attacker and to accept multimodal image_url inputs (the vision/chat-completions media-fetch path) - the default behavior when serving a vision-language model without the new --allowed-media-domains allowlist configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and point to a real but not urgent priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the exposed lmdeploy API server sends a POST to the chat/completions endpoint with an image_url pointing to a server they control; that server responds with an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/ or an internal loopback service. lmdeploy follows the redirect without re-checking the destination against its private-IP safety guard, fetching the internal resource and returning or exposing internal service responses or cloud IAM credentials. … |
| Remediation | Upgrade to a build of lmdeploy that contains the upstream fix in pull request #4734 / commit 03c313006d17cc3feae86b633c44206a997c44db; the upstream fix is available (PR/commit) but a released patched version tag is not independently confirmed from the provided data, so verify the exact release with the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory deployments of InternLM lmdeploy by version and environment to establish attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery (SSRF) in InternLM LMDeploy's vision-language module allows remote unauthenticated attackers
A vulnerability was found in InternLM LMDeploy up to 0.7.1. Rated medium severity (CVSS 4.8), this vulnerability is low
A vulnerability was found in InternLM LMDeploy up to 0.7.1. Rated medium severity (CVSS 4.8), this vulnerability is low
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today