CVE-2026-33626: 
Python vulnerability analysis and mitigation

CVE-2026-33626 is a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module, specifically in the load_image() function within lmdeploy/vl/utils.py. The function fetches arbitrary URLs without validating whether the target resolves to internal or private IP addresses, enabling unauthenticated attackers to reach cloud metadata services, internal networks, and other sensitive resources. All versions of LMDeploy prior to 0.12.3 with vision-language (VL) support are affected. The vulnerability was discovered by Igor Stepansky of Orca Security, first reported on February 4, 2026, published to the GitHub Advisory Database on April 21, 2026, and assigned CVE-2026-33626. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, GitHub Security Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the load_image() function in lmdeploy/vl/utils.py (lines 64–67) and the encode_image_base64() function (lines 26–29) issue requests.get() calls against attacker-supplied URLs with no prior validation of the resolved IP address. Compounding the risk, the LMDeploy API server binds to 0.0.0.0 by default and API key authentication is disabled by default, meaning any network-reachable attacker can submit a crafted POST /v1/chat/completions request containing a malicious image_url pointing to internal addresses such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. The server then fetches the URL and may return the response content to the attacker. No authentication, special privileges, or user interaction are required for exploitation (Github Advisory, GitHub Security Advisory).

Successful exploitation allows an unauthenticated remote attacker to exfiltrate highly sensitive data, including AWS/GCP/Azure instance metadata and IAM security credentials, internal service responses, and other resources not exposed to the internet. The primary impact is a high confidentiality loss — attackers can harvest cloud authentication tokens and secrets that enable lateral movement into cloud environments or further compromise of internal infrastructure. Integrity and availability are not directly impacted by this vulnerability, but stolen credentials can be leveraged for follow-on attacks with broader consequences (Github Advisory, Sysdig Blog).

Active in-the-wild exploitation was confirmed within approximately 12–13 hours of the advisory's public disclosure, making this one of the fastest-exploited AI infrastructure vulnerabilities on record (Sysdig Blog, The Hacker News). A concrete, reproducible proof-of-concept exploit payload targeting the /v1/chat/completions endpoint is publicly documented in the official security advisory, requiring no modification or custom tooling (Github Advisory). A Nuclei detection template was also added to the ProjectDiscovery nuclei-templates repository. The EPSS score is reported at 8.696% (93rd percentile) by the GitHub Advisory Database, indicating elevated exploitation probability. No specific threat actor attribution has been published, and the vulnerability is not currently listed in the CISA KEV catalog based on available data.

1. Reconnaissance: Identify internet-facing LMDeploy instances using tools like Shodan or Censys, searching for services exposing the OpenAI-compatible API (default port 23333 or 8080). Confirm the server is running a vision-language model by querying /v1/models.
2. Confirm no authentication: Verify that the API server does not require an API key (the default configuration has authentication disabled).
3. Craft malicious request: Construct a POST /v1/chat/completions JSON payload with a content array containing an image_url entry pointing to a target internal resource, such as the AWS EC2 metadata endpoint:

{
  "model": "internlm-xcomposer2",
  "messages": [{
    "role": "user",
    "content": [
      {"type": "text", "text": "Describe this image"},
      {"type": "image_url", "image_url": {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}}
    ]
  }]
}

4. Send the request: Submit the crafted request to the vulnerable LMDeploy server. The load_image() function fetches the URL server-side without any IP validation.
5. Harvest credentials: The server's response (or error output) contains the content retrieved from the internal metadata service, including IAM role names and temporary AWS security credentials.
6. Lateral movement: Use the harvested cloud credentials to access AWS/GCP/Azure APIs, escalate privileges, or pivot to other cloud resources (Github Advisory, Sysdig Blog).

• Network: Outbound HTTP requests from the LMDeploy server process to 169.254.169.254 (AWS/GCP metadata), 169.254.170.2 (ECS metadata), 100.100.100.200 (Alibaba Cloud metadata), RFC-1918 addresses (10.x.x.x, 172.16.x.x, 192.168.x.x), or 127.0.0.1/localhost.
• Network: Unexpected outbound connections from the LMDeploy host to attacker-controlled callback servers (e.g., unusual external IPs on non-standard ports) shortly after API requests.
• Logs: API access logs showing POST /v1/chat/completions requests with image_url values containing internal IP addresses, 169.254.x.x, localhost, or 127.0.0.1.
• Logs: Application-level errors or stack traces in LMDeploy logs referencing load_image() or encode_image_base64() with internal/private URLs.
• Process: The LMDeploy Python process initiating unexpected outbound HTTP connections (observable via netstat, ss, or EDR process network telemetry) to non-public IP ranges.
• File System: Presence of Nuclei scan artifacts or automated scanning tool outputs targeting LMDeploy API endpoints on the host or in adjacent network logs (Github Advisory, Sysdig Blog).

The primary remediation is to upgrade LMDeploy to version 0.12.3 or later, which introduces the _is_safe_url() validation function in lmdeploy/vl/media/connection.py that blocks requests to non-globally-routable IP addresses (loopback, private, link-local, etc.) and limits redirect behavior (GitHub Release, GitHub PR #4447). As interim mitigations: enable API key authentication on the LMDeploy server, implement network egress controls to block outbound connections from the LMDeploy host to RFC-1918 and link-local ranges, and deploy a WAF or network proxy to inspect and block SSRF-indicative requests. Avoid exposing LMDeploy API servers directly to the internet without authentication (Github Advisory).

The vulnerability attracted significant attention due to the speed of exploitation — Sysdig published a detailed technical blog documenting how attackers exploited LMDeploy inference engines within 12 hours of disclosure, highlighting the acute risk to AI infrastructure (Sysdig Blog). The Hacker News, GBHackers, SecurityOnline, and SC World all covered the story, emphasizing the broader trend of AI/ML tooling becoming a high-value attack surface (The Hacker News). Check Point Research included CVE-2026-33626 in their AI Threat Landscape Digest for March–April 2026, noting it as part of a growing pattern of SSRF vulnerabilities in multimodal AI frameworks (Check Point Research). Community discussion on Reddit (r/netsec, r/cybersecurity, r/SecOpsDaily) and Mastodon was active, with researchers sharing exploit details and defenders requesting detection guidance. Emerging Threats updated their ruleset (v11179) to include detection for this vulnerability within days of disclosure.