CVE-2026-33626: LMDeploy vision-language load_image() SSRF via unvalidated URLs

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityNetwork-reachable, unauthenticated SSRF with high confidentiality impact and a high EPSS percentile, though no KEV listing or known ransomware use.

What it is

LMDeploy versions before 0.12.3 have a server-side request forgery flaw in the vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal or private IP addresses, so a request can be pointed at cloud metadata services or internal network resources. Version 0.12.3 patches the issue.

Impact

An attacker can make the LMDeploy server issue requests to internal addresses, potentially reading cloud instance metadata credentials and reaching sensitive internal services. The CVSS vector shows high confidentiality impact with no integrity or availability effect.

Attack surface

Reachable over the network through the vision-language image loading path, with no authentication and no user interaction required per the CVSS vector (AV:N/PR:N/UI:N). Any interface that accepts an image URL and passes it to load_image() is exposed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.4525 (98.7th percentile), indicating elevated predicted exploitation activity. The vendor advisory reference is tagged Exploit, so public exploit detail exists.

What to do

• Upgrade LMDeploy to 0.12.3 or later, which patches the flaw.
• If upgrade is not immediate, block outbound requests from LMDeploy hosts to private, link-local and cloud metadata ranges (169.254.169.254, RFC1918, loopback).
• Restrict the vision-language endpoint to trusted clients and require authentication where possible.
• Apply egress filtering and network segmentation so the LMDeploy service cannot reach internal management or metadata services.
• Review the vendor advisory GHSA-6w67-hwm5-92mq for any additional mitigations.

Detection

• Monitor LMDeploy host outbound connections to 169.254.169.254 and RFC1918 addresses for unexpected image fetches.
• Log and alert on load_image() or vision-language requests containing URLs with internal, loopback or metadata hostnames.
• Watch for repeated or anomalous HTTP requests originating from the LMDeploy process to non-public destinations.
• Correlate LMDeploy access logs with egress firewall denials to spot SSRF probing attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.