VULNpocalypse

CVE-2026-63764: LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.

Description quoted from the CVE record (assigned by VulnCheck, published 2026-07-21).

Weakness: Server-Side Request Forgery (SSRF)

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and no user interaction. Impact: confidentiality none, integrity none, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: yes. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Also known as: EUVD-2026-46412, GHSA-rqhf-rg9p-w5gg

VEDAS cluster: VEDAS:CRYSTALMYSTIQUE

Exploit Observer links 5 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (5)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Vulnerability databases and vendor advisories (3)

Catalogue entries, not exploit evidence.

1 more reference returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS
0.005
low predicted chance of attack
VEDAS
0.986
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Nuclei · Suricata

Who is affected

ProductAffectedNot affected
InternLM lmdeployup to and including 0.14.003c313006d17 is not affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

Exploit Observer also maps it to: internlm lmdeploy.

How to fix it

Vendor guidance:

How to detect it

Nuclei template (active check)

LMDeploy - Server-Side Request Forgery

LMDeploy through 0.14.0 exposes an OpenAI-compatible inference API server whose media handler (_load_http_url in connection.py) fetches image_url values supplied in a chat completions request. The private-IP guard validates only the originally submitted URL and does not re-validate the host after following HTTP redirects, so an unauthenticated client can point image_url at an attacker-controlled host and reach internal services or cloud-metadata endpoints. This template first reads the served model name from /v1/models, then submits a chat completion whose image_url references a unique out-of-band host; a resulting DNS interaction confirms the server performs the attacker-directed fetch.

Name and description quoted from the template, written by VEDAS.

The template sends 2 requests (GET /v1/models, POST /v1/chat/completions); it confirms through an out-of-band callback (interactsh), so the scanner must be able to receive it; it decides using regex, word matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash
nuclei -u https://your-host -t CVE-2026-63764.yaml
Show the template (57 lines)
yaml
id: CVE-2026-63764

info:
  name: "LMDeploy - Server-Side Request Forgery"
  author: vedas-arpsyndicate
  severity: high
  description: |
    LMDeploy through 0.14.0 exposes an OpenAI-compatible inference API server whose
    media handler (_load_http_url in connection.py) fetches image_url values supplied
    in a chat completions request. The private-IP guard validates only the originally
    submitted URL and does not re-validate the host after following HTTP redirects, so
    an unauthenticated client can point image_url at an attacker-controlled host and
    reach internal services or cloud-metadata endpoints. This template first reads the
    served model name from /v1/models, then submits a chat completion whose image_url
    references a unique out-of-band host; a resulting DNS interaction confirms the
    server performs the attacker-directed fetch.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-63764&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=lmdeploy&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
    cvss-score: 7.7
    cve-id: CVE-2026-63764
    cwe-id: CWE-918
  metadata:
    verified: false
  tags: cve,cve2026,lmdeploy,ssrf,oast
http:
  - raw:
      - |
        GET /v1/models HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

      - |
        POST /v1/chat/completions HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"model":"{{model}}","messages":[{"role":"user","content":[{"type":"text","text":"describe this image"},{"type":"image_url","image_url":{"url":"http://{{interactsh-url}}/vedas.png"}}]}],"max_tokens":1}

    extractors:
      - type: regex
        name: model
        part: body
        internal: true
        regex:
          - '"id"\s*:\s*"([^"]+)"'
        group: 1

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        name: dns
        words:
          - "dns"

CVE-2026-63764.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-63764 LMDeploy - Server-Side Request Forgery. Add them to your Suricata rule set and reload.

Show the rules
suricata
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-63764 LMDeploy - Server-Side Request Forgery"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/v1/chat/completions"; nocase; http.request_body; content:"image_url"; nocase; fast_pattern; content:"http"; nocase; classtype:web-application-attack; reference:cve,CVE-2026-63764; reference:url,https://www.exploit.observer/?keyword=CVE-2026-63764&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=lmdeploy&match=exact; sid:1090800; rev:1;)

CVE-2026-63764.rules on GitHub

References

Vendor advisories and patches

Exploits and technical analysis

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.