Executive brief
InternLM lmdeploy, a toolkit for deploying large language models, contains a security flaw in its API server that allows unauthorized individuals to access internal network resources. By providing a specially crafted image link, an attacker can trick the server into connecting to private internal services or cloud metadata endpoints that are normally protected. This could lead to the theft of sensitive internal data or cloud credentials, potentially compromising the entire server environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in lmdeploy's OpenAI-compatible API server due to improper validation of HTTP redirects when fetching multimodal images. The `_is_safe_url` function in `lmdeploy/vl/media/connection.py` validates the initial URL against a private-IP guard, but the subsequent `requests.get` call follows redirects (`allow_redirects=True`) without re-validating subsequent hops. An unauthenticated attacker can send a POST request to the `/v1/chat/completions` endpoint with an `image_url` pointing to a malicious server that issues a 302 redirect to internal addresses (e.g., 127.0.0.1 or 169.254.169.254). This allows the attacker to bypass the safety guard and retrieve content from internal services or cloud metadata endpoints.
Affected products
- InternLM lmdeploy up to and including commit 648df3b
Timeline
- 2026-06-12: disclosed: Initial report to maintainers via GitHub Security Advisory
- 2026-07-18: disclosed: Public issue opened on GitHub repository
- 2026-07-21: advisory: NVD and VulnCheck advisories published