AIKIDO-2026-62813
lmdeploy is vulnerable to Server-Side Request Forgery (SSRF)
92
Critical Risk
This Affects:
lmdeployTL;DR
LMDeploy's OpenAI-compatible API server fetches remote images referenced by a request's image_url. The _is_safe_url guard validates only the initial URL and then lets the HTTP client follow redirects automatically, so a user-supplied URL that first points to an allowed host can return a redirect to loopback, link-local, or cloud metadata addresses that the server then fetches. This lets unauthenticated requests reach internal services and instance-metadata endpoints behind the server. The fix disables automatic redirect following and re-validates every redirect hop against the private-address guard.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you serve a multimodal model whose OpenAI-compatible API accepts remote image_url inputs from untrusted callers.
Background info
lmdeploy is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.12.3 - 0.14.0.
How to fix this
Upgrade the lmdeploy library to the patch version.
Links
GitHub Release
Related Issue
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.