CVE-2026-123818: LMDeploy: SSRF via URL parser mismatch leaks internal data

HIGH

Published November 9, 2026

CISO Take

LMDeploy, a popular toolkit for serving LLMs, contains a server-side request forgery flaw: its URL safety check parses remote media URLs differently than the HTTP library that fetches them, so a backslash trick makes an internal address look public. An unauthenticated attacker over the network can use this to make the inference server reach internal HTTP services and read the responses, which is why the CVSS confidentiality impact is high (7.5). There is no KEV listing, no public exploit, no Nuclei template and no EPSS data yet, and only 1 downstream dependent is tracked, so mass exploitation looks unlikely today. The risk is concentrated in internet-facing deployments that accept remote image or media URLs, especially in cloud environments where the metadata service can expose credentials. Upgrade to LMDeploy 0.15.0 (affected: 0.12.3 up to 0.15.0), and until then block egress from inference hosts to internal ranges and cloud metadata endpoints.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium-to-high. The attack is network-reachable, needs no privileges or user interaction and is low complexity, with a confidentiality-only impact (CVSS 7.5). Exploitation likelihood is moderated by the lack of a public exploit, KEV listing or scanner template, and EPSS data is not available. Exposure depends on whether the serving endpoint accepts attacker-controlled remote media URLs (for example multimodal or vision requests). Deployments in cloud or flat internal networks face the highest impact, because the server can be used as a pivot to metadata services, internal admin APIs and other model-serving backends. The package has had 13 other CVEs, which points to a recurring security maintenance burden.

How does the attack unfold?

Initial Access

The attacker sends a crafted remote media URL to an exposed LMDeploy inference endpoint.

AML.T0049

Validation Bypass

The URL passes the urlparse-based safety check because the hostname appears globally routable, while requests interprets the backslash to target an internal host.

AML.T0040

Internal Access

The server fetches content from an internal HTTP service on the attacker's behalf, such as a metadata endpoint or admin API.

AML.T0036

Impact

Sensitive internal data or cloud credentials are exposed to the attacker, enabling lateral movement into the AI platform.

Initial Access

The attacker sends a crafted remote media URL to an exposed LMDeploy inference endpoint.

AML.T0049

Validation Bypass

The URL passes the urlparse-based safety check because the hostname appears globally routable, while requests interprets the backslash to target an internal host.

AML.T0040

Internal Access

The server fetches content from an internal HTTP service on the attacker's behalf, such as a metadata endpoint or admin API.

AML.T0036

Impact

Sensitive internal data or cloud credentials are exposed to the attacker, enabling lateral movement into the AI platform.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LMDeploy	pip	—	No patch
8.1K1 dependentsPushed 7d ago43% patched~18d to patchFull package profile →

Do you use LMDeploy? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade LMDeploy to 0.15.0 or later (fix in PR 4734 and commit 03c3130). 2) If you cannot patch immediately, disable or restrict remote media URL fetching, or put the endpoint behind an authenticated gateway that rejects URLs containing backslashes or encoded variants. 3) Enforce egress filtering from inference hosts to RFC1918 ranges, loopback, link-local addresses and cloud metadata endpoints (169.254.169.254). Enforce IMDSv2 or equivalent on cloud instances. 4) Detect by reviewing inference API logs for media URLs containing backslashes, userinfo tricks or internal hostnames, and monitor for unusual outbound connections from serving nodes to internal services. 5) Rotate any credentials reachable from internal services that the serving host could access if you see suspicious requests.

How is it classified?

Data ExtractionData LeakageInferenceAPIFrameworkAML.T0036- Data from Information Repositories AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown or newly identified risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-123818?

Is CVE-2026-123818 actively exploited?

No confirmed active exploitation of CVE-2026-123818 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123818?

1) Upgrade LMDeploy to 0.15.0 or later (fix in PR 4734 and commit 03c3130). 2) If you cannot patch immediately, disable or restrict remote media URL fetching, or put the endpoint behind an authenticated gateway that rejects URLs containing backslashes or encoded variants. 3) Enforce egress filtering from inference hosts to RFC1918 ranges, loopback, link-local addresses and cloud metadata endpoints (169.254.169.254). Enforce IMDSv2 or equivalent on cloud instances. 4) Detect by reviewing inference API logs for media URLs containing backslashes, userinfo tricks or internal hostnames, and monitor for unusual outbound connections from serving nodes to internal services. 5) Rotate any credentials reachable from internal services that the serving host could access if you see suspicious requests.

What systems are affected by CVE-2026-123818?

This vulnerability affects the following AI/ML architecture patterns: model serving, multimodal inference APIs, LLM inference gateways, cloud-hosted AI platforms.

What is the CVSS score for CVE-2026-123818?

CVE-2026-123818 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

model servingmultimodal inference APIsLLM inference gatewayscloud-hosted AI platforms

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation hostname appears globally routable but whose request destination resolves to an internal host, bypassing non-global address checks. Applications that accept attacker-controlled remote media URLs can therefore be induced to access internal HTTP services and expose data available from those services. This issue is fixed in version 0.15.0.

Exploitation Scenario

An attacker finds an internet-facing LMDeploy multimodal endpoint that accepts image URLs in chat requests. They submit a URL such as one whose hostname looks public to urlparse but contains a backslash, so the requests library sends the request to an internal host instead, for example a cloud metadata service or an internal admin API. The validator passes the URL, the server fetches the internal resource, and the content is processed or reflected in the response or error output. The attacker repeats this to enumerate internal services and extract temporary cloud credentials or other sensitive data, then uses them to move into the surrounding AI infrastructure.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.