A Critical Vulnerability in LMDeploy, the Open-Source Toolkit Used to Deploy Large Language Models, Was Disclosed on GitHub Last Week. Twelve Hours and Thirty-One Minutes Later, an Attacker Was Already in the Honeypot. Eight-Minute Session. Ten Requests. AWS Metadata, Redis, MySQL, Internal Admin Interfaces. The Patch-to-Exploit Window Is Now Measured in Hours.

WHAT HAPPENED

LMDeploy is an open-source toolkit maintained by InternLM for compressing, deploying, and serving large language models. It is widely used in environments that self-host LLM inference, particularly in research labs, AI startups, and enterprises running internal models. The vision-language module supports models that take both image and text input. The load_image() function in lmdeploy/vl/utils.py fetches images from URLs the user provides. The function did not validate internal or private IP addresses.

That single missing check is the vulnerability. An attacker submitting a malicious image URL can redirect the server to fetch from any address, including internal network resources the LMDeploy server can reach but the public internet cannot. The vulnerability affects all versions of LMDeploy at 0.12.0 and below with vision-language support enabled.

The advisory was published on GitHub. Twelve hours and thirty-one minutes later, an attacker operating from IP address 103.116.72.119 hit Sysdig's honeypot. The session lasted eight minutes. The attacker ran ten distinct requests across three phases. They rotated between two different vision-language models (internlm-xcomposer2 and OpenGVLab/InternVL2-8B) during the session to avoid leaving a clean detection signature on any single model.

THE ATTACK SEQUENCE

The Sysdig research walks through the attacker's three phases. The framing matters because it shows the attacker was not merely validating that the bug existed. They were operationalizing it.

Phase one: SSRF confirmation. The attacker sent a request that triggered LMDeploy to fetch an image URL pointing at requestrepo.com, an out-of-band DNS callback service. When Sysdig's honeypot resolved the requestrepo.com hostname, the attacker confirmed two things at once. The SSRF was real, and the model server could reach external hosts.

Phase two: API surface enumeration. The attacker probed LMDeploy's exposed endpoints, mapping which features and models were available. This is preparation work. Different models route requests through different code paths. Knowing the full API surface lets an attacker pick which path to abuse.

Phase three: internal network reconnaissance. The attacker turned the SSRF into a generic HTTP scanning tool against the internal network behind the model server. Specific targets included AWS Instance Metadata Service (the IMDS endpoint at 169.254.169.254 that issues temporary cloud credentials to EC2 instances), Redis on TCP 6379, MySQL on TCP 3306, a secondary HTTP administrative interface, and the loopback address 127.0.0.1 for any local services. Eight minutes. Ten requests. Complete internal-network reconnaissance from a public-facing model server through a vulnerability disclosed twelve and a half hours earlier.

THE PATTERN

Sysdig's analysts named the pattern directly. "CVE-2026-33626 fits a pattern we have observed repeatedly in the AI-infrastructure space over the past six months: critical vulnerabilities in inference servers, model gateways, and agent orchestration tools are being weaponized within hours of advisory publication, regardless of the size or extent of their install base." This is the framing every CISO with AI infrastructure in production needs to internalize. The attacker did not need a public proof-of-concept. The advisory text alone was sufficient.

This is the third AI infrastructure exploitation story we have covered in five days. On April 21 we covered OX Security's research on architectural RCE in Anthropic's Model Context Protocol, with downstream exposure across 150 million downloads and 200,000 vulnerable servers. On April 24 we covered the Bloomberg report on the Mythos vendor breach, where a Discord forum accessed Anthropic's restricted-release model on launch day through a third-party contractor. Today's LMDeploy case completes the picture. The MCP story was about how AI infrastructure protocols are designed. The Mythos story was about how AI access is governed. The LMDeploy story is about how fast AI infrastructure vulnerabilities get exploited once they are disclosed. Three different layers of the same problem.

The broader context matters. A single open-source maintainer, a small AI startup, or a research lab that publishes an advisory on GitHub now has roughly half a day before the first exploitation attempts arrive. The attackers are watching the same advisory feeds defenders are watching. They are building exploits from the technical details in the advisory itself. The patch-to-exploit window has collapsed to a single workday.

WHY AI INFRASTRUCTURE IS PARTICULARLY VULNERABLE

Most AI infrastructure tooling is younger than the security maturity of the rest of the enterprise stack. LMDeploy, MCP, agent orchestration frameworks, model gateways, and inference servers are all software categories that did not exist three years ago in their current form. They have been built quickly, often by small teams, often as open-source projects with limited security review. The functionality is novel. The security primitives are not yet proven.

The LMDeploy vulnerability is a classic SSRF. Web application security teams have been finding and fixing SSRF flaws for fifteen years. The reason this one shipped to production is that AI infrastructure code is being written by ML engineers, not by web application security specialists, and the same input validation patterns that web frameworks have built-in defaults for are not yet built into AI-specific tooling. Every AI inference server that fetches user-provided URLs needs an SSRF defense. Most of them do not have one.

The same dynamic applies to authentication on model serving endpoints, to authorization for agent tool calls, to logging on AI workflow orchestration, to secrets management for model API keys. These are all problems with twenty years of security best practices. They are also problems that AI infrastructure is solving from scratch, often badly, often quickly. The LMDeploy case is what happens when the gap between AI tooling maturity and attacker velocity collapses to a single workday.

INDICATORS AND TECHNICAL DETAILS

WHAT DEFENDERS SHOULD DO