CVE-2026-123818— LMDeploy URL parser disagreement permits SSRF filter bypass

Quick assessment

Affected

InternLM lmdeploy

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LMDeploy 是一个用于压缩、部署和提供大型语言模型服务的工具包。在从 0.12.3 到 0.15.0 的版本中，函数使用对远程媒体 URL 进行验证，而在发送请求时对反斜杠的解析方式存在差异。攻击者可构造一个 URL，使其在验证阶段的主机名看似为全局可路由地址，但实际请求目标却解析为内部主机，从而绕过对非全局地址的检查。因此，任何接受攻击者控制的远程媒体 URL 的应用程序，都可能被诱导访问内部 HTTP 服务，进而暴露这些服务中可获取的数据。该问题已在 0.15.0 版本中修复。

CVSS 7.5 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1595 · Active Scanning T1071 · Application Layer Protocol

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

LMDeploy URL parser disagreement permits SSRF filter bypass

Source: CVE Program / CVE List V5

Vulnerability Description

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation hostname appears globally routable but whose request destination resolves to an internal host, bypassing non-global address checks. Applications that accept attacker-controlled remote media URLs can therefore be induced to access internal HTTP services and expose data available from those services. This issue is fixed in version 0.15.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
InternLM	lmdeploy	>= 0.12.3, < 0.15.0	-

II. Public POCs for CVE-2026-123818

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123818

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-123818 (1)

🔗 fix: restrict remote media domains by CUHKSZzxy · Pull Request #4734 · InternLM/lmdeploy · GitHub x_refsource_MISC

Other References for CVE-2026-123818 (2)

https://github.com/InternLM/lmdeploy/releases/tag/v0.15.0 x_refsource_MISC
https://github.com/InternLM/lmdeploy/security/advisories/GHSA-39wr-7q6h-cf68 x_refsource_CONFIRM

https://www.cve.org/CVERecord?id=CVE-2026-123818

IV. Related Vulnerabilities

Same product: lmdeploy

Same vendor: InternLM

Same weakness: CWE-918