lmdeploy OpenAI-Compatible API Server SSRF via Redirect-Bypassed image_url Validation

Technical Analysis

The vulnerability (CVE-2026-63764, CVSS 9.3) exists in lmdeploy's multimodal chat completions endpoint, where the image_url parameter undergoes a one-time safety check against a blocklist of internal/loopback addresses but does not re-validate subsequent HTTP redirect hops. An attacker hosts a malicious server returning a 302 redirect to targets such as 127.0.0.1, internal service ports, or cloud metadata endpoints (e.g., 169.254.169.254), allowing retrieval of IAM credentials, instance metadata, or internal API responses via the server's outbound fetch. Because the endpoint is unauthenticated by default in many deployments, exploitation requires no prior access — only network reachability to the lmdeploy inference server. This class of vulnerability is common in multimodal LLM serving stacks that fetch remote image URLs without hardened SSRF protections (no re-check per redirect, no DNS rebinding defense). For AI agent systems: lmdeploy is frequently deployed as a backend inference server for agentic and RAG applications processing image inputs, so successful exploitation could leak cloud credentials or API keys used by the agent orchestration layer, enabling lateral movement into the broader agent infrastructure.

Affected Systems

lmdeploy OpenAI-compatible API server (versions prior to the patched release addressing CVE-2026-63764); deployments exposing the /v1/chat/completions or equivalent multimodal endpoint with image_url support; self-hosted or cloud-hosted instances running on AWS, GCP, or Azure where instance metadata services are reachable from the inference host.

Indicators of Compromise

• Suspicious outbound HTTP requests from lmdeploy hosts to attacker-controlled domains preceding 302 redirects
• Requests to internal metadata endpoints (169.254.169.254, metadata.google.internal) originating from lmdeploy process
• Unusual image_url parameters referencing external attacker infrastructure in API logs
• Repeated POST requests to /v1/chat/completions with non-standard or shortened image_url domains

Remediation Steps

1. 1

   Upgrade lmdeploy

   Apply the vendor patch that enforces per-redirect-hop validation against the internal address blocklist for image_url fetches.

2. 2

   Network segmentation

   Isolate lmdeploy inference hosts from sensitive internal networks and cloud metadata services using egress firewall rules or metadata service hardening (e.g., IMDSv2 enforcement, hop-limit restrictions).

3. 3

   Disable or restrict remote image fetching

   If not required, disable the image_url feature or restrict it to an allowlist of trusted external domains.

4. 4

   Add authentication

   Require authentication/authorization on the API server rather than exposing it unauthenticated, reducing the attack surface for SSRF exploitation.

5. 5

   Rotate exposed credentials

   If the server runs in a cloud environment, rotate IAM credentials and API keys accessible via metadata endpoints and audit for unauthorized use.

6. 6

   Monitor and log outbound requests

   Implement logging and alerting on outbound HTTP requests from the inference server, particularly those resulting in redirects to internal IP ranges.