CVE-2026-63764 lmdeploy Server-Side Request Forgery via HTTP Redirect Bypass of Private-IP Guard in Vision Image Fetch

lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted imageurl that redirects to internal targets. Attackers can send a POST request to the...