Skip to content
AgentProv

2026-04-21 · 2026-Q2

LMDeploy SSRF Exploited Within 13 Hours of Public Disclosure (CVE-2026-33626)

Primary layerL8 Output / DestinationSecondary:L1 Credential

Where is this data going, and who chose that?

The question layer 8 asks, and failed here.
Fixable
Vendor patch
Vendor response
Patched
In the wild
Yes
Actor
Attacker

Target

LMDeploy LLM serving toolkit by Shanghai AI Laboratory / InternLM (all versions 0.12.0 and earlier with vision-language support)

Impact

Sysdig honeypot recorded the first exploit attempt 12 hours and 31 minutes after the GitHub advisory went live; attackers used the vision-language image loader as a generic HTTP SSRF primitive to port-scan internal networks behind the model server, hit AWS Instance Metadata Service (IMDS), Redis, MySQL, a secondary HTTP admin interface, and an out-of-band DNS exfiltration endpoint, all in a single eight-minute session

Root cause

`load_image()` in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal or private IP ranges; fix in 0.12.3 adds URL validation and IP filtering

CVE

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: LMDeploy SSRF Exploited Within 13 Hours of Public Disclosure (CVE-2026-33626) (2026-04-21). https://agentprov.com/incidents/2026-04-21-lmdeploy-ssrf-exploited-within-13-hours-of-public-disclosure-cve-2026-33626

Related