CVE-2026-63764: SSRF in LMDeploy’s OpenAI-Compatible API Server
ResearchLMDeployOur summary
A critical server-side request forgery (SSRF) vulnerability has been identified in LMDeploy’s OpenAI-compatible API server, affecting versions up to 0.14.0. The flaw allows unauthenticated attackers to exploit a redirect bypass, enabling access to internal services and cloud metadata endpoints such as 169.254.169.254. This could lead to the exposure of sensitive information like IAM credentials. The issue was reported on June 12, 2026, but went unaddressed for over a month before being publicly disclosed. A fix was merged into the main branch via PR #4734, though no official release has included it yet. Users are advised to apply strict egress filtering until an updated version is available.
Below is the opening; the full story is at OX Security.
From OX Security
How a 302 redirect bypass in LMDeploy turns an AI inference server into an internal proxy — and why 36 days of maintainer silence is a warning sign
Overview
lmdeploy’s OpenAI-compatible API server (≤ 0.14.0) validates the initial image_url host but then follows HTTP redirects without re-checking each hop. An unauthenticated attacker can host a public URL that passes the safety guard, then returns a 302 pointing at 127.0.0.1 or the cloud metadata endpoint (169.254.169.254). The server follows it inward, exposing internal services and IAM credentials.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.