CVE-2026-63764: lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated
Summary
lmdeploy's OpenAI-compatible API server has a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended targets) that lets unauthenticated attackers access internal services and cloud metadata by sending a crafted image URL. The vulnerability works because the server follows HTTP redirects (automatic jumps to new URLs) without re-checking safety rules at each step, allowing attackers to bypass initial URL validation.
Vulnerability Details
9.3(critical)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
network
low
none
none
July 21, 2026
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-63764
First tracked: July 22, 2026 at 02:07 AM
Classified by LLM (prompt v3) · confidence: 92%