Sysdig Observes LMDeploy SSRF Exploitation Attempt 12 Hours After Advisory
Summary
Sysdig says its honeypot saw an LMDeploy CVE-2026-33626 SSRF exploitation attempt 12 hours 31 minutes after the GitHub advisory. Requests targeted cloud metadata and internal services; the article recommends upgrading to v0.12.3 and restricting egress.
Key points
- Sysdig TRT reports observing 10 requests over eight minutes from 103.116.72.119, 12 hours 31 minutes after the main GitHub advisory was published; it says no public PoC was available at the time.
- The CVE-2026-33626 flaw affects LMDeploy's image_url handling, which fetched user-supplied URLs without adequate hostname or private-network checks.
- Observed requests targeted AWS IMDS, loopback Redis and MySQL, and local HTTP services. The reported probes do not establish that credentials were obtained or services compromised.
- The attacker also tested an out-of-band callback, enumerated the API, and probed an unauthenticated distributed-serving endpoint; the article does not report resulting service disruption.
- Sysdig recommends upgrading to LMDeploy v0.12.3 or later, enforcing IMDSv2, restricting outbound egress, rotating credentials potentially exposed on affected deployments, and monitoring inference-process requests to internal addresses.
Article Details
- Attack Vectors
- The attacker exploited CVE-2026-33626 through LMDeploy's image_url handling, which fetched user-supplied HTTP or HTTPS URLs without adequate host or scheme validation.
- The SSRF requests targeted AWS instance metadata and loopback services, including Redis, MySQL, and local HTTP endpoints, to probe internal resources.
- The attacker used an out-of-band callback to requestrepo.com to test whether the vulnerable server could reach external hosts.
- The attacker enumerated the API, then invoked the unauthenticated /distserve/p2p_drop_connect endpoint; the article says this endpoint can disrupt inference by tearing down a ZMQ link, but does not confirm disruption occurred.
- Defensive Notes
- Upgrade LMDeploy to v0.12.3 or later; if that is not possible, filter image_url values with a reverse proxy or disable vision-model endpoints.
- Enforce IMDSv2 and configure a hop limit that prevents containers from reaching instance metadata.
- Restrict outbound egress from inference servers and block requests to link-local, loopback, and private network ranges.
- Rotate IAM credentials associated with publicly reachable LMDeploy deployments running v0.12.2 or earlier.
- Bind internal services to private interfaces, require authentication for administrative endpoints, and monitor inference processes for connections to internal or metadata addresses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cw2mhnbd[.]requestrepo[.]com | Unique OOB callback subdomain used during the session to test SSRF and external egress. |
| IPV4 | 103[.]116[.]72[.]119 | Source IP observed for the exploitation attempt; the article cautions it may be a proxy, VPN endpoint, or rented cloud instance. |
MITRE ATT&CK
T1046 · Network Service DiscoveryThe attacker used SSRF requests to probe loopback ports associated with Redis, MySQL, and local HTTP services.T1190 · Exploit Public-Facing ApplicationThe attacker exploited the publicly reachable LMDeploy inference API's image_url SSRF to request internal resources.T1499 · Endpoint Denial of ServiceThe attacker invoked /distserve/p2p_drop_connect, an unauthenticated endpoint the article says can disrupt inference by tearing down a ZMQ link; disruption was not confirmed.T1552.005 · Cloud Instance Metadata APIThe attacker requested the AWS instance metadata IAM security-credentials path; the article reports that credentials were fetched.
CVE
Vendors
Products
LMDeployGitHub published GHSA-6w67-hwm5-92mq (CVE-2026-33626), a Server-Side Request Forgery (SSRF) in LMDeploy’s vision-language image loader, and Sysdig observed the first exploitation attempt against a honeypot 12 hours andSysdig SecureSysdig Secure ships several out-of-the-box Falco rules that fire on exactly the URLs the attacker attempted.