7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33626

CVE-2026-33626: LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33626

CVE-2026-33626:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
lmdeploy	pip	<= 0.12.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the LMDeploy library, which allows an unauthenticated attacker to make the server issue requests to arbitrary URLs. The root cause is the lack of input validation on URLs provided for image loading.

The analysis of the provided patch in commit 71d64a339edb901e9005358e0633fbbab367d626 shows that the core vulnerability is in the _load_http_url function located in lmdeploy/vl/media/connection.py. This function was responsible for making the HTTP request via requests.get without ensuring the destination URL was not a private or internal address. The fix involves adding a new function, _is_safe_url, which performs this validation, and ensuring _load_http_url calls it before proceeding.

The vulnerability report explicitly identifies load_image in lmdeploy/vl/utils.py as the primary vulnerable function that takes the user-supplied URL. It also mentions encode_image_base64 as being affected. This indicates a call chain where encode_image_base64 may call load_image, which in turn leads to the call to the unsafe _load_http_url function. Therefore, all three functions would likely appear in a stack trace during an exploit and are considered part of the vulnerable functionality.

Vulnerable functions

_load_http_url

lmdeploy/vl/media/connection.py

This function is responsible for fetching content from a given URL. Before the patch, it directly used `requests.get` without validating if the URL pointed to an internal or private IP address, making it vulnerable to SSRF. The patch added a call to the `_is_safe_url` function to validate the URL before making the request.

load_image

lmdeploy/vl/utils.py

This function is the entry point for loading an image from a URL. It takes the user-provided URL and passes it to other functions for processing, including the vulnerable `_load_http_url` function, without performing any validation itself. It is a key component in the vulnerable call chain.

encode_image_base64

lmdeploy/vl/utils.py

This function is part of the vulnerable workflow. It likely calls the `load_image` function to handle image data from a URL before encoding it. As part of the call stack processing the malicious user input, it would appear in a runtime profile during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.