High severity · published Apr 20, 2026
CVE-2026-33626
LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
7.5
CVSS
45.2%
EPSS
No
On KEV
Description
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)45.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LM
lmdeploy · InternLM
< 0.12.3 · source: vendor, NVD
In the news
VulnerabilityHigh
LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure
A high-severity security flaw in LMDeploy, an open-source toolkit for compressing, deploying, and serving LLMs, has come under active exploitation in the wild less than 13 hours after its public disclosure.
The vulnerability, tracked as CVE-2026-33626 (CVSS score: 7.5), relates to a Server-Side Request Forgery (SSRF) vulnerability that could be exploited to access sensitive data.
"A server-side
Apr 24, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33626
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33626
Patch
https://github.com/InternLM/lmdeploy/commit/71d64a339edb901e9005358e0633fbbab367d626
Issue Tracking
https://github.com/InternLM/lmdeploy/pull/4447
Release Notes
https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3
Exploit
https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq
More from lmdeploy
9.8
CVE-2025-66455
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
9.8
CVE-2025-59953
LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
9.8
CVE-2026-76850
LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector
8.8
CVE-2026-33625
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
8.8
CVE-2025-67729
lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()