External risk intelligence

lmdeploy API Server Side Request Forgery via HTTP Redirect

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-63764

The vulnerability exists in an OpenAI-compatible API server designed to handle chat completions. Such services are commonly deployed as internet-facing or externally accessible application endpoints to facilitate API integration, making them a standard part of an exposed web services architecture.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the lmdeploy OpenAI-compatible API server could allow unauthenticated attackers to access internal services and cloud metadata by crafting a request with a malicious image URL. This could lead to unauthorized information disclosure or access to internal resources. The main concern is confirming relevance and exposure.

Server could be tricked into revealing internal information.
Attackers can bypass safety checks to access services.
Confirm if our services are exposed to this risk.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to the chat completions endpoint. This request would include an image URL that redirects to an internal service or cloud metadata endpoint. The API server follows this redirect, bypassing its safety checks and allowing the attacker to access sensitive internal information.

No authentication needed to attack.
Triggered by a redirecting image URL.
Risk of accessing internal services and metadata.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to access internal services and sensitive cloud metadata endpoints. This is possible when the API server processes a crafted image URL that redirects to internal targets, bypassing safety checks designed to prevent access to restricted network locations.

Internal service and cloud metadata.
Crafted image URL with HTTP redirect.
Unauthorized access to internal resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in lmdeploy's API server is likely to affect teams responsible for application deployment and integration. The primary immediate action is to identify all instances of the affected technology, confirm their accessibility and criticality, and then assign ownership for remediation.

Application and platform teams own this.
Verify external accessibility and criticality.
Plan targeted remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is lmdeploy and why is it used?

lmdeploy is an open-source toolkit designed to compress, deploy, and serve large language models (LLMs). It includes an OpenAI-compatible API server that allows developers to integrate LLM capabilities into their own applications by processing text and vision inputs, such as images provided via URL for analysis.

What does CVE-2026-63764 mean?

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability, classified as CWE-918. It happens because the API server fails to re-validate security checks after following a URL redirect. Essentially, the software can be tricked into fetching data from internal locations it should not access, such as private cloud metadata services, because it trusts the destination provided by an external redirect.

How is this SSRF vulnerability triggered?

An attacker triggers the flaw by sending a POST request to the chat completions endpoint with an image_url that points to a server they control. That server then issues an HTTP 302 redirect to an internal IP address or metadata endpoint. The vulnerability does not trigger if the API server strictly blocks all redirects or verifies the final destination of every URL hop against a safe allow-list.

Who should be concerned about this vulnerability?

Organizations running an internet-facing lmdeploy API server should be concerned. According to Halo Surface Signal, these services are typically deployed as externally accessible endpoints for API integration, which increases the likelihood that an attacker could reach the server and attempt to exploit this flaw to probe internal network resources.

What should I do if I am running lmdeploy?

Begin by identifying all active instances of the lmdeploy API server within your environment. Determine which ones are accessible from the internet versus those confined to internal networks. Once mapped, coordinate with your application teams to restrict access where possible and monitor official project channels for updates or configuration guidance to mitigate the redirect-following behavior.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.