LMDeploy SSRF Hijacks AI Inference Engines

A high-severity Server-Side Request Forgery (SSRF) vulnerability, designated CVE-2026-33626, has emerged in the LMDeploy toolkit, posing a significant threat by enabling attackers to hijack AI inference engines. This critical flaw, first disclosed on April 21, 2026, has sparked considerable concern within the cybersecurity community. Recognized for its role in serving vision-language and large language models (LLMs), LMDeploy is now under vigilant scrutiny. Attackers exploiting this vulnerability can manipulate AI inference processes, compromising systems that rely on this framework.

In the wake of this revelation, cybersecurity experts have stressed the magnitude of the flaw. Several other vulnerabilities, including CVE-2026-3844 and CVE-2026-33825, have been mentioned in the same advisory. Organizations utilizing LMDeploy are urged to implement protective measures and update their systems promptly to mitigate risks. Detailed insights and recommended security practices are available in the full report.

For more in-depth analysis and the latest updates, read the full article here:

CVE-2026-33626: High-Severity SSRF Exploited in the Wild to Hijack AI Inference Engines