# LMDeploy SSRF in load_image() Vision-Language Module (CVE-2026-33626) — Actively Exploited Within 13 Hours of Disclosure

> InternLM LMDeploy <= 0.12.0 contains a server-side request forgery (SSRF) vulnerability in the load_image() helper of lmdeploy/vl/utils.py. The function fetches arbitrary URLs supplied to vision-language models without validating the destination, allowing unauthenticated attackers to coerce the inference server into requesting AWS Instance Metadata Service (169.254.169.254), loopback admin interfaces, internal Redis/MySQL services, and arbitrary intranet hosts. Active exploitation was observed 12 hours 31 minutes after public disclosure, with attackers using out-of-band DNS exfiltration via requestrepo[.]com to steal IMDS-issued cloud credentials.

- **Published:** 2026-04-27T12:00:00Z
- **Last reviewed:** 2026-04-27T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0426
- **ID:** TL-2026-0426
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33626

## Description

CVE-2026-33626 is a server-side request forgery (SSRF) vulnerability in InternLM's LMDeploy, a widely deployed open-source toolkit for compressing, deploying, and serving large language and vision-language models (VLMs). The flaw resides in the helper function load_image() located at lmdeploy/vl/utils.py, which is invoked whenever a vision-capable endpoint (such as the OpenAI-compatible /v1/chat/completions API) receives an image_url field referencing an HTTP(S) URL. The function passes the URL directly to a Python urllib/requests fetch without validating the scheme, host, or resolved IP, and without enforcing an allowlist or blocking link-local, loopback, or RFC1918 destinations.

An unauthenticated remote attacker who can reach the LMDeploy inference endpoint can supply a crafted message such as { "role": "user", "content": [{"type": "image_url", "image_url": {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}}] }. The server fetches the URL server-side and returns the body (or a fetch error containing the body) to the client, leaking AWS Instance Metadata Service v1 (IMDSv1) responses including STS-issued temporary credentials when the EC2 instance role permits it. The same primitive is abused to enumerate internal services (Redis 6379, MySQL 3306, Kubernetes API 6443, admin dashboards on 127.0.0.1), to perform out-of-band DNS-based data exfiltration via requestrepo[.]com subdomains, and to scan internal CIDR ranges from inside the victim's VPC.

The vulnerability was reported privately by Igor Stepansky of Orca Security to InternLM on 2026-04-15. InternLM published GitHub Security Advisory GHSA-6w67-hwm5-92mq and released LMDeploy 0.12.1 with the patch on 2026-04-21, adding hostname/IP validation that rejects link-local, loopback, multicast, and private ranges before any network fetch. CVE-2026-33626 was assigned by MITRE on 2026-04-22 and active exploitation began the same day at 03:35 UTC — 12 hours and 31 minutes after the public advisory — sourced from 103.116.72.119. Sysdig threat researchers documented the exploitation pattern on 2026-04-23, observing wide internet-scale scanning for exposed LMDeploy endpoints (default port 23333 and 8000) and image_url SSRF probes against discovered hosts.

The attack chain is: (1) discover an internet-exposed LMDeploy server hosting a vision-capable model such as internlm-xcomposer2 or OpenGVLab/InternVL2-8B; (2) send a crafted chat completion request with a malicious image_url; (3) confirm SSRF reachability via OOB DNS callback to attacker-controlled requestrepo[.]com; (4) read /latest/meta-data/iam/security-credentials/ from IMDS to obtain AWS STS access/secret/session tokens; (5) pivot using the stolen credentials to S3, ECR, and other cloud resources, and use the same SSRF to enumerate internal services for data theft and lateral movement. Defenders should treat any exposed LMDeploy inference endpoint as compromised until proven otherwise, rotate all IAM role credentials issued to the host, and patch to LMDeploy >= 0.12.1 immediately. EC2 hosts running LMDeploy should be migrated to IMDSv2 (token-required) which mitigates basic SSRF retrieval of credentials.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1592 Gather Victim Host Information
- T1583.001 Acquire Infrastructure: Domains
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1580 Cloud Infrastructure Discovery
- T1526 Cloud Service Discovery
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1071.004 Application Layer Protocol: DNS
- T1071.001 Application Layer Protocol: Web Protocols
- T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
- T1567 Exfiltration Over Web Service
- T1496 Resource Hijacking

## Sources

- [GitHub Security Advisory GHSA-6w67-hwm5-92mq — LMDeploy SSRF in load_image](https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq)
- [InternLM/lmdeploy v0.12.1 Release — Patch for CVE-2026-33626](https://github.com/InternLM/lmdeploy/releases/tag/v0.12.1)
- [NVD CVE-2026-33626 Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-33626)
- [The Hacker News — LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours](https://thehackernews.com/2026/04/lmdeploy-cve-2026-33626-flaw-exploited.html)
- [Check Point Research — 27th April 2026 Threat Intelligence Report](https://research.checkpoint.com/2026/27th-april-threat-intelligence-report/)
- [Sysdig Threat Research — LMDeploy SSRF Exploitation Analysis](https://sysdig.com/blog/lmdeploy-ssrf-cve-2026-33626/)
- [Orca Security — Discovery and Disclosure of CVE-2026-33626](https://orca.security/resources/blog/lmdeploy-ssrf-cve-2026-33626/)
- [InternLM/lmdeploy GitHub Repository](https://github.com/InternLM/lmdeploy)
- [MITRE ATT&CK T1552.005 — Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005/)
- [AWS — Configuring IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-existing-instances.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0426