PatchSiren cyber security CVE debrief
CVE-2026-63764 InternLM CVE debrief
The lmdeploy OpenAI-compatible API server has a server-side request forgery (SSRF) vulnerability. This vulnerability allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted image_url that redirects to internal targets. The vulnerability exists because the API server follows HTTP redirects without re-validating each hop through the safety guard. This could lead to unauthorized access to sensitive internal services and cloud metadata. Users of lmdeploy's OpenAI-compatible API server should be aware of this vulnerability and take immediate action to protect their systems.
- Vendor
- InternLM
- Product
- lmdeploy
- CVSS
- CRITICAL 9.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Users of lmdeploy's OpenAI-compatible API server, particularly those with exposed deployments, should be aware of this vulnerability and take immediate action to protect their systems. This includes administrators, security teams, and operators who manage or interact with the affected API server. Additionally, vulnerability management and security teams should prioritize patching or mitigating this vulnerability to prevent potential unauthorized access to internal services and cloud metadata.
Technical summary
The vulnerability exists in lmdeploy's OpenAI-compatible API server, which allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted image_url that redirects to internal targets. Attackers can send a POST request to the chat completions endpoint with an image_url pointing to an attacker-controlled server that responds with an HTTP 302 redirect to internal addresses such as loopback or instance-metadata endpoints, bypassing the initial URL safety check because redirects are followed without re-validating each hop through the safety guard.
Defensive priority
High
Recommended defensive actions
- Immediately update lmdeploy to the latest version
- Restrict access to the chat completions endpoint
- Implement additional security measures to detect and prevent SSRF attacks
- Monitor system logs for suspicious activity
- Consider implementing a web application firewall to detect and prevent malicious traffic
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-21T21:16:53.350Z and was last modified on 2026-07-22T16:27:18.220Z. The NVD entry is currently Awaiting Analysis. This information is based on the supplied source corpus and has not been independently verified. Defenders should verify the accuracy of this information with official sources and assess their own exposure.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T21:16:53.350Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.