CVE-2026-63764: Server-Side Request Forgery in lmdeploy OpenAI-Compatible API Server

CVE-2026-63764 describes a critical server-side request forgery (SSRF) vulnerability within lmdeploy's OpenAI-compatible API server. This flaw permits unauthenticated attackers to bypass URL safety checks and gain unauthorized access to internal services and sensitive cloud metadata. The exploitation occurs when an attacker sends a POST request to the chat completions endpoint with a specially crafted image_url parameter. This image_url points to an attacker-controlled server, which then issues an HTTP 302 redirect. Crucially, the lmdeploy server follows this redirect to internal network addresses, such as loopback interfaces or cloud instance-metadata endpoints, without re-validating the redirected URL against its initial safety guard. This bypass allows for the exfiltration of sensitive information or interaction with internal resources, posing a significant risk to the integrity and confidentiality of the affected systems.

Attack Chain

1. An attacker identifies an exposed lmdeploy OpenAI-compatible API server instance.
2. The attacker crafts a malicious POST request targeting the /v1/chat/completions endpoint of the lmdeploy server.
3. The crafted request includes an image_url parameter set to a URL pointing to an attacker-controlled web server.
4. The lmdeploy server initiates a request to the attacker-controlled server specified in the image_url.
5. The attacker-controlled server responds with an HTTP 302 (Found) redirect, where the Location header specifies an internal target, such as http://169.254.169.254/latest/meta-data/ for AWS EC2 metadata or a local loopback address.
6. The lmdeploy server follows this 302 redirect without performing subsequent URL validation on the redirected internal target.
7. The server accesses the specified internal service or cloud metadata endpoint as if it were a legitimate request originating from within the trusted network.
8. The attacker receives the response from the internal service or cloud metadata, gaining unauthorized access to sensitive information or internal functionalities.

Impact

Successful exploitation of CVE-2026-63764 allows unauthenticated attackers to access internal services and cloud metadata endpoints. This can lead to the exposure of sensitive cloud credentials, internal network topology, configuration data, and potentially enable further lateral movement or privilege escalation within the compromised environment. The vulnerability carries a CVSS v3.1 base score of 9.3, indicating a critical severity and high potential for widespread damage, including severe confidentiality breaches and service disruption if internal systems are manipulated.

Recommendation

• Patch CVE-2026-63764 immediately by updating lmdeploy's OpenAI-compatible API server to a version where this vulnerability is resolved.
• Deploy the Sigma rule "Detect CVE-2026-63764 Exploitation Attempt - SSRF via image_url" to your SIEM to identify attempts at exploiting this vulnerability.
• Monitor webserver logs for unusual POST requests to the chat completions endpoint containing image_url parameters with suspicious IP addresses or internal domain patterns.