← Back to Vulnerability Reports CVE Intelligence

CVE-2026-33626

Internlm Lmdeploy•HIGH · CVSS 7.5•No exploitation reported

What is CVE-2026-33626?

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.

CVSS7.5 NVD 3.1
SeverityHIGH
ExploitationNo exploitation reported
EPSS2% · P74
Triage statusNo Known Exploit
ActionPatch this week
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWECWE-918
NVD published2026-04-20
NVD last modified2026-06-17

Timeline

  • 2026-04-20Published to the U.S. National Vulnerability Database (NVD)
  • 2026-06-17NVD record last updated

Affected product

Internlm Lmdeploy

Remediation Steps

  1. Update LMDeploy to patched version immediately via pip or package manager
  2. Audit server logs for SSRF attack attempts targeting internal resources
  3. Implement network-level restrictions on outbound requests from LMDeploy instances
  4. Review and restrict IAM permissions for LMDeploy service accounts
  5. Deploy Web Application Firewall rules to block suspicious SSRF patterns

References

Referenced in our briefings & reports

Related vulnerabilities

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.