Attack Chain

1. An attacker identifies an exposed lmdeploy OpenAI-compatible API server instance.
2. The attacker crafts a malicious POST request targeting the /v1/chat/completions endpoint of the lmdeploy server.
3. The crafted request includes an image_url parameter set to a URL pointing to an attacker-controlled web server.
4. The lmdeploy server initiates a request to the attacker-controlled server specified in the image_url.
5. The attacker-controlled server responds with an HTTP 302 (Found) redirect, where the Location header specifies an internal target, such as http://169.254.169.254/latest/meta-data/ for AWS EC2 metadata or a local loopback address.
6. The lmdeploy server follows this 302 redirect without performing subsequent URL validation on the redirected internal target.
7. The server accesses the specified internal service or cloud metadata endpoint as if it were a legitimate request originating from within the trusted network.
8. The attacker receives the response from the internal service or cloud metadata, gaining unauthorized access to sensitive information or internal functionalities.

Impact

Successful exploitation of CVE-2026-63764 allows unauthenticated attackers to access internal services and cloud metadata endpoints. This can lead to the exposure of sensitive cloud credentials, internal network topology, configuration data, and potentially enable further lateral movement or privilege escalation within the compromised environment. The vulnerability carries a CVSS v3.1 base score of 9.3, indicating a critical severity and high potential for widespread damage, including severe confidentiality breaches and service disruption if internal systems are manipulated.

Recommendation

• Patch CVE-2026-63764 immediately by updating lmdeploy's OpenAI-compatible API server to a version where this vulnerability is resolved.
• Deploy the Sigma rule "Detect CVE-2026-63764 Exploitation Attempt - SSRF via image_url" to your SIEM to identify attempts at exploiting this vulnerability.
• Monitor webserver logs for unusual POST requests to the chat completions endpoint containing image_url parameters with suspicious IP addresses or internal domain patterns.