The Vulnerability
CVE-2026-33626 is a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy, a toolkit for compressing, deploying, and serving large language models. The flaw exists in the vision-language module's load_image() function in lmdeploy/vl/utils.py. This function fetches URLs without validating internal or private IP addresses, allowing attackers to make the server request arbitrary resources (NVD).
How It Was Exploited
Within 12 hours of the public advisory on April 21, 2026, threat actors leveraged the SSRF to scan internal networks, access cloud metadata services, and enumerate internal services. The attack vector uses the vision-LLM endpoint, which processes image URLs submitted by users. By supplying URLs pointing to internal infrastructure, attackers can pivot from the AI serving layer into the broader network (Sysdig).
Impact and Severity
The vulnerability carries a CVSS score of 7.5 (High). Affected versions are LMDeploy prior to 0.12.3. Organizations running LMDeploy in production, especially those exposing vision-language endpoints, are at risk of data exposure and lateral movement. The rapid exploitation shows that attackers actively monitor AI infrastructure disclosures (The Hacker News).
How to Protect Yourself
- Upgrade to LMDeploy version 0.12.3 or later, which includes proper validation of URL inputs.
- Restrict network access to vision-language endpoints; avoid exposing them to untrusted users.
- Monitor outbound requests from AI inference services for anomalous patterns.
- Review cloud metadata service configurations to limit exposure from compromised nodes.