CVE-2026-63764Disclosure(internlm / lmdeploy)

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch internlm lmdeploy systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.

internlm CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

lmdeploy

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-07-21); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

internlm

Products

lmdeploy

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

OX Security@OX__Security90d
Disclosure
🚨 CVE-2026-63764: Critical SSRF in LMDeploy’s OpenAI-compatible API server. A crafted image_url can redirect requests to internal services or cloud metadata endpoints, exposing IAM credentials. Affects LMDeploy ≤0.14.0. No patched release yet. FULL REPORT: https://www.ox.security/blog/cve-2026-63764-ssrf-in-lmdeploys-openai-compatible-api-server/ -- #CyberSecurity #AISecurity #CVE
Post summary
The post announces a newly reported critical SSRF vulnerability in LMDeploy’s OpenAI-compatible API server, detailing the exploit vector and impact while noting that no patch is yet available.
00011175
367 followersView on X
Kaitan ID Security@KaitanSecurity91d
Disclosure
🚨 CRITICAL — CVE-2026-63764 lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticate… CVSS 9.3 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-63764 #OpenAI #CyberSecurity #InfoSec
Post summary
A newly disclosed CVE-2026-63764 vulnerability in lmdeploy’s OpenAI‑compatible API server is a server‑side request forgery with a CVSS of 9.3 and is currently unpatched.
0000162
88 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	internlm	lmdeploy	-	-	-

Explore more

Back to dashboard internlm CVEs lmdeploy vulnerabilities