lmdeploy's OpenAI API Server Exposed to SSRF via Redirects

NVD has added a newly published record describing a server-side request forgery issue in the lmdeploy project.

The vulnerability allows unauthenticated attackers to access internal services. According to the entry, the OpenAI-compatible API server in lmdeploy can be abused by unauthenticated parties who leverage a crafted image_url parameter to reach internal services and cloud metadata endpoints. The reported CVSS 3.1 base score assigned by VulnCheck stands at 9.3 critical.

Attackers exploit the flaw through crafted POST requests. A malicious actor reportedly sends a POST to the chat completions endpoint using an image_url that first targets an attacker-controlled server. That server returns an HTTP 302 redirect aimed at loopback addresses or instance-metadata services. The bypass occurs because the implementation follows redirects but skips any further safety validation on subsequent hops.

The vulnerability is tracked as CVE-2026-63764. VulnCheck supplied the CVE record that reached the NVD dataset on July 21, 2026. It is classified under CWE-918 for Server-Side Request Forgery. A separate CVSS 4.0 vector supplied by the same CNA scores the issue 9.2 critical.

References point to the lmdeploy project and a detailed advisory. The NVD entry contains links to the project's GitHub repository, an open issue at https://github.com/InternLM/lmdeploy/issues/4761, and the VulnCheck advisory that first detailed the redirect bypass. No patch information is listed in the current record.