PT-2026-62099 · Internlm · Lmdeploy

George Chen · CVE-2026-63764 · Publicado 2026-07-21 · Atualizado 2026-07-21

Mitre

CVSS v3.1

9.3

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted image url that redirects to internal targets. Attackers can send a POST request to the chat completions endpoint with an image url pointing to an attacker-controlled server that responds with an HTTP 302 redirect to internal addresses such as loopback or instance-metadata endpoints, bypassing the initial URL safety check because redirects are followed without re-validating each hop through the safety guard.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-63764

Produtos afetados

Lmdeploy

Referências · 4

• https://github.com/InternLM/lmdeploy/issues/4761 · Nota
• https://github.com/InternLM/lmdeploy · Correção
• https://vulncheck.com/advisories/lmdeploy-server-side-request-forgery-via-http-redirect-bypass-of-private-ip-guard-in-vision-image-fetch · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63764 · Nota de Segurança