CVE-2026-33626

LMDeploy, an open-source toolkit for compressing, deploying, and serving large language models, contains a server-side request forgery (SSRF) flaw in its vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs supplied to image-loading requests without validating that the resolved host is not an internal or private IP address, so any unauthenticated network caller can direct the server to request attacker-chosen URLs. An attacker can leverage this to reach cloud metadata services (e.g., to steal instance credentials), probe internal networks, and access other sensitive resources reachable from the LMDeploy server. Anyone running LMDeploy versions prior to 0.12.3, particularly deployments exposing the vision-language serving API to untrusted networks, is affected. The flaw was reportedly exploited in the wild within 13 hours of disclosure, and version 0.12.3 patches the issue.

What to do: Upgrade to LMDeploy 0.12.3 or later. Until patched, restrict network access to LMDeploy serving endpoints, apply egress filtering so the server can only reach approved hosts, and block requests to private IP ranges and cloud metadata endpoints (e.g., 169.254.169.254); review server logs for unexpected outbound URL fetches or signs of metadata-service access.