CVE-2026-63764
This vulnerability lets attackers trick the lmdeploy API into fetching data from internal network addresses. By sending a specially crafted image_url that redirects to internal services, an attacker can read sensitive information such as cloud metadata. The flaw is exploitable without authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
lmdeploy's OpenAI-compatible API server. Users who deploy the lmdeploy API server and expose the chat completions endpoint to the internet are affected.
Real-world impact
An attacker could read internal network resources, including cloud instance metadata, potentially exposing credentials or configuration data.
Why this severity
The CVSS score of 9.2 reflects that the flaw is easy to exploit (low attack complexity), requires no user interaction, and gives attackers high impact on confidentiality and integrity by allowing them to read internal data.
What to do about it
- ›Disable or remove the image_url feature from the chat completions endpoint until a patch is released.
- ›Restrict outbound network access from the API server to prevent it from following redirects to internal addresses.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources