{"id":37128,"date":"2026-04-25T00:24:37","date_gmt":"2026-04-24T22:24:37","guid":{"rendered":"https:\/\/www.cloudmagazin.com\/2026\/04\/25\/exploit-ssrf-vision-cloud-architecture\/"},"modified":"2026-06-22T18:28:19","modified_gmt":"2026-06-22T16:28:19","slug":"cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation","status":"publish","type":"post","link":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/","title":{"rendered":"LMDeploy CVE-2026-33626: SSRF Lessons for AI Stacks"},"content":{"rendered":"<div style=\"background:#004a59;color:#fff;padding:6px 14px;border-radius:999px;display:inline-block;font-size:13px;font-weight:600;letter-spacing:0.4px;margin-bottom:16px;\">DEEP ANALYSIS \u00b7 AI INFRASTRUCTURE<\/div>\n<p style=\"color:#6190a9;font-size:0.9em;margin:0 0 16px;padding:0;\">9 Min. read time<\/p>\n<p><strong>On 22 April 2026 at 03:35\u202fUTC, Sysdig observed the first real\u2011world exploit attempt against CVE\u20112026\u201133626 in a honeypot, 12\u202fhours and 31\u202fminutes after the GitHub advisory was published. The attack path in a Vision\u2011Language\u2011Model installation of LMDeploy traversed the AWS Instance Metadata Service, a local Redis instance, and a MySQL backend port in less than eight minutes. For cloud architects, the case is less a LMDeploy issue than an architectural one: why are inference servers even placed in the same VPC segment as stateful back\u2011ends; who bears operational responsibility for this segmentation in the 2026 AI stack?<\/strong><\/p>\n<h2>Key Takeaways<\/h2>\n<\/p>\n<ul>\n<li>CVE\u20112026\u201133626 in LMDeploy (CVSS\u202f7.5): Vision\u2011LLM SSRF via the load_image() function, exploit documented by Sysdig\u2019s honeypot within 12.5\u202fhours of the advisory (22\u202f04\u202f2026, 03:35\u202fUTC).<\/li>\n<li>Attack chain: Vision API endpoint loads arbitrary URL without private\u2011IP validation. Result: IMDS access (169.254.169.254), internal service enumeration, cloud\u2011credential exfiltration.<\/li>\n<li>The exploit leverages request\u2011repo callbacks and rotating models (internlm\u2011xcomposer2, InternVL2\u20118B) for obfuscation. Tool\u2011driven, not handcrafted.<\/li>\n<li>Structural lesson: model servers should not share the same VPC segment as stateful back\u2011ends. Private\u2011IP blockers alone are no longer sufficient protection in 2026.<\/li>\n<li>For DACH cloud architects this means three concrete tasks: network segmentation, IMDSv2 enforcement, and LLM\u2011specific egress monitoring in the next sprint planning.<\/li>\n<\/ul>\n<h2 style=\"color:#004a59;\">What CVE\u20112026\u201133626 Generates Technically<\/h2>\n<p><strong>What is Server\u2011Side Request Forgery (SSRF)?<\/strong> SSRF describes a class of vulnerabilities where an attacker tricks a server into sending HTTP requests to targets that are not directly reachable by the attacker. Traditionally, attackers use this to reach internal services (metadata endpoints, databases, admin interfaces) that should be isolated from the public internet. In inference stacks, SSRF is especially dangerous because Vision\u2011LLM servers are architected to fetch images from arbitrary URLs\u2013and that very default behavior is the attack vector.<\/p>\n<p>In LMDeploy the flaw resides in the load_image() function in the module lmdeploy\/vl\/utils.py. The function accepts a URL and loads the image for the downstream vision pipeline. Private\u2011IP validation is missing in the affected version. An attacker sends a normal vision request with a URL such as http:\/\/169.254.169.254\/latest\/meta-data\/iam\/security-credentials\/ and, as long as the inference server holds AWS IAM credentials, receives the corresponding metadata response. The Vision\u2011LLM becomes the messenger that publishes its own cloud credential store.<\/p>\n<p>The attack chain observed by Sysdig is methodical and tool\u2011driven. Phase one: call to the AWS IMDS for credential exfiltration. Phase two: probes against localhost Redis (port\u202f6379) to enumerate loosely configured key\u2011value caches. Phase three: MySQL port\u202f3306 scans on internal addresses, flanked by out\u2011of\u2011band DNS callbacks via requestrepo.com to confirm blind SSRF paths. According to Sysdig, the entire sequence completes in under eight minutes and, due to model rotations, is harder to detect than a classic script\u2011kiddie attack.<\/p>\n<h3 style=\"color:#004a59;\">Why Inference Stacks Are Systematically Vulnerable<\/h3>\n<p>Vision\u2011Language\u2011Model servers have a property that rarely appears so strongly in the classic backend world: their functional task is to fetch and process external content. That makes them a born\u2011in SSRF vector. At the same time, these servers are run in many DACH inference stacks in the same VPC segments as vector databases, feature stores and application caches, because latency is being optimized and the architecture looks \u201clogical\u201d on the whiteboard. This very co\u2011location is no longer tenable in 2026.<\/p>\n<div style=\"display:flex;flex-wrap:wrap;gap:16px;margin:40px 0;\">\n<div style=\"flex:1;min-width:200px;background:#004a59;border-radius:8px;padding:20px 24px;\">\n<div style=\"font-size:11px;font-weight:700;color:#0bb7fd;text-transform:uppercase;letter-spacing:0.5px;margin-bottom:8px;\">KEY METRIC<\/div>\n<div style=\"font-size:36px;font-weight:800;color:#0bb7fd;line-height:1;white-space:nowrap;\">04.202<\/div>\n<div style=\"font-size:13px;color:#fff;margin-top:8px;opacity:0.8;line-height:1.3;\">6, 03:35 UTC). Attack chain: Vision\u2011API endpoint loads bel<\/div>\n<\/div>\n<div style=\"flex:1;min-width:200px;background:#002535;border-radius:8px;padding:20px 24px;\">\n<div style=\"font-size:11px;font-weight:700;color:#0bb7fd;text-transform:uppercase;letter-spacing:0.5px;margin-bottom:8px;\">KEY METRIC<\/div>\n<div style=\"font-size:36px;font-weight:800;color:#0bb7fd;line-height:1;white-space:nowrap;\">169.254.169.254<\/div>\n<div style=\"font-size:13px;color:#fff;margin-top:8px;opacity:0.8;line-height:1.3;\">), internal service enumeration, cloud\u2011credential exfiltratio<\/div>\n<\/div>\n<div style=\"flex:1;min-width:200px;background:#00364a;border-radius:8px;padding:20px 24px;\">\n<div style=\"font-size:11px;font-weight:700;color:#0bb7fd;text-transform:uppercase;letter-spacing:0.5px;margin-bottom:8px;\">KEY METRIC<\/div>\n<div style=\"font-size:36px;font-weight:800;color:#0bb7fd;line-height:1;white-space:nowrap;\">30.000<\/div>\n<div style=\"font-size:13px;color:#fff;margin-top:8px;opacity:0.8;line-height:1.3;\">and \u20ac90,000 in the first year (license, integration, operat<\/div>\n<\/div>\n<\/div>\n<h2 style=\"color:#004a59;\">Three Metrics from the Sysdig Advisory<\/h2>\n<div class=\"stat-block-row\" style=\"display:grid;grid-template-columns:repeat(3,1fr);gap:16px;margin:24px 0;\">\n<div style=\"background:#0a1e3d;color:#fff;padding:20px;border-radius:10px;\">\n<div style=\"font-size:32px;font-weight:700;color:#0bb7fd;\">12.5\u202fh<\/div>\n<div style=\"font-size:14px;color:#fff;margin-top:6px;\">from the GitHub advisory to the first exploit attempt according to Sysdig honeypot data. 22.04.2026, 03:35\u202fUTC.<\/div>\n<\/div>\n<div style=\"background:#0a1e3d;color:#fff;padding:20px;border-radius:10px;\">\n<div style=\"font-size:32px;font-weight:700;color:#0bb7fd;\">CVSS\u202f7.5<\/div>\n<div style=\"font-size:14px;color:#fff;margin-top:6px;\">Severity of the vulnerability, driven by high exploitability and typical impact dimensions (credential exfiltration, internal scanning).<\/div>\n<\/div>\n<div style=\"background:#0a1e3d;color:#fff;padding:20px;border-radius:10px;\">\n<div style=\"font-size:32px;font-weight:700;color:#0bb7fd;\">3\u202fPhases<\/div>\n<div style=\"font-size:14px;color:#fff;margin-top:6px;\">Attack flow: IMDS access, local service enumeration (Redis, MySQL), out\u2011of\u2011band callback verification via requestrepo.com.<\/div>\n<\/div>\n<\/div>\n<figure style=\"margin:36px 0;padding:0;\">\n<blockquote style=\"position:relative;margin:0;padding:30px 34px 28px;background:linear-gradient(135deg,#013a47 0%,#004a59 100%);border-radius:12px;box-shadow:0 10px 30px rgba(0,40,60,0.18);overflow:hidden;\"><p>\n<span aria-hidden=\"true\" style=\"position:absolute;right:22px;top:6px;font-family:Georgia,serif;font-size:90px;line-height:1;color:#0bb7fd;opacity:0.18;\">&rdquo;<\/span><\/p>\n<div style=\"font-family:'SF Mono','Monaco','Consolas',monospace;font-size:10.5px;color:#0bb7fd;letter-spacing:0.18em;text-transform:uppercase;margin-bottom:13px;\">\/\/ Key point<\/div>\n<p style=\"margin:0;font-size:1.15em;line-height:1.6;color:#f2fafd;font-weight:500;position:relative;\">The difference between \u201csecurity by design\u201d and \u201csecurity by incident\u201d is roughly a week of sleep. For inference stacks, the gap has shrunk to the 12.5\u202fhours between advisory and the first exploit.<\/p>\n<\/blockquote>\n<\/figure>\n<h2 style=\"color:#004a59;\">The Three Homework Assignments for Cloud Architects<\/h2>\n<h3 style=\"color:#004a59;\">Homework 1: Inference Servers in Separate VPC Segments<\/h3>\n<p>The first and most important measure: vision and language model servers belong in dedicated VPC segments with no direct route to stateful back\u2011ends such as Redis, MySQL, Postgres, MongoDB or internal admin interfaces. This isn\u2019t theory, it follows from the functional nature of the model server (it can load arbitrary URLs). In Terraform configurations this translates to: own subnets, own security groups with explicit egress rules, no peering routes to database subnets. Anyone lacking this segmentation cannot fully block the LMDeploy exploit, no matter how quickly a patch is applied.<\/p>\n<p>A pragmatic intermediate step: introduce an \u201cAI zone\u201d as a third security zone alongside the DMZ and the internal network. In the AI zone run model servers, model gateways and vector\u2011DB replicas. Stateful back\u2011ends stay in the internal network. Traffic between zones travels exclusively via service accounts with tight policies. In our engagements we see this topology can be rolled out in four to six weeks, even in brownfield environments with existing infrastructure.<\/p>\n<h3 style=\"color:#004a59;\">Homework 2: Enforce IMDSv2, Disallow v1 Calls<\/h3>\n<p>The LMDeploy exploit retrieved IAM credentials through the IMDSv1 path (simple HTTP GET to 169.254.169.254). AWS has defined IMDSv2 as the default since 2023, but many legacy deployments still run on v1. Azure and GCP offer analogous metadata services with similar protection mechanisms. The operational consequence: enforce IMDSv2 in all EC2 launch templates (HttpTokens = \u201crequired\u201d), secure Azure Instance Metadata Service with required headers, and protect GCP metadata with Metadata\u2011Flavor header checks. For DACH teams managing multiple AWS accounts we recommend an SCP policy at the organization level that globally bans IMDSv1. This also catches legacy workloads that slip through in single\u2011account configurations.<\/p>\n<h3 style=\"color:#004a59;\">Homework 3: LLM\u2011Specific Egress Monitoring<\/h3>\n<p>Classic SIEM often misses an SSRF attack on a vision LLM because the requests look like normal image loads. Detection works better at the egress layer: which destinations has the inference server actually contacted? If a vision LLM made 15 requests to 169.254.169.254 in the last hour, that\u2019s a signal. If the same server sends requests to requestrepo.com, oast.pro or burpcollaborator.net, that\u2019s another. Concrete implementation: an egress proxy with allowlist\u2011based routing and alerting on anomalies in outbound traffic. Without this, you only see the attack in billing reports after the credentials have already been exfiltrated.<\/p>\n<h3 style=\"color:#004a59;\">Looking at the Supply Chain of Inference Components<\/h3>\n<p>Another hidden aspect in the current case is the supply\u2011chain dimension. LMDeploy is an open\u2011source component used in many DACH production stacks, often as a transitive dependency in custom inference pipelines or as part of third\u2011party Helm\u2011chart Kubernetes deployments. Teams without a clear SBOM (Software Bill of Materials) for their AI infrastructure have no idea where LMDeploy is active when an incident occurs. That turns patching into a treasure\u2011hunt and dramatically slows response time.<\/p>\n<p>The pragmatic counter\u2011step: generate an SBOM for the entire AI stack, ideally automated via CycloneDX or SPDX generation in the CI pipeline. For mid\u2011size teams, a weekly SBOM snapshot with a delta report in the first year\u2013highlighting critical CVEs against the internal component list\u2013is sufficient. The tooling (Trivy, Syft, Dependency\u2011Track) is available; the organization just needs to adopt it. Teams that start now will be far better prepared for the next CVE in three weeks than those that had to hunt for LMDeploy manually.<\/p>\n<h2 style=\"color:#004a59;\">What This Means for Your Own Patch Process<\/h2>\n<p>The rapid\u2011exploitation observation with LMDeploy is not an outlier. CVE\u20112026\u201133626 joins a series of inference\u2011stack vulnerabilities that were exploited in hours rather than weeks in 2026. This has consequences for the patch process. A classic 30\u2011day patch SLA is no longer adequate for inference stacks. The new expectation: critical patches to AI\u2011server components within 24 to 72\u202fhours, ideally automated via Helm\u2011chart updates with policy\u2011gated rollouts.<\/p>\n<p>For DACH organizations this means an investment in the patch pipeline: continuous CVE monitoring for the entire AI\u2011stack inventory (LMDeploy, vLLM, TGI, Ray Serve, Triton, Ollama, LiteLLM), clear ownership per component, and automatic rollouts with a canary strategy. Teams without such a pipeline are structurally outside the 24\u2011hour response window that 2026 demands.<\/p>\n<p>The organizational side is often more challenging than the technical one. Many DACH teams have the patch process for application servers and databases well under control because responsibilities are clear there. AI stacks sit between platform engineering, data science, and security, and each side assumes the other is responsible. The implication for leaders in this environment: formally designate a patch owner for each AI component, with escalation SLAs and accountability displayed on the operations dashboard. Treating the issue as a side\u2011matter won\u2019t get the next CVE fixed faster\u2013it will get fixed later. The ownership question is the one that will determine your organization\u2019s patch capability over the next three quarters. Leaving it unresolved delays every subsequent exploit case by exactly as long as the coordination among the three teams takes.<\/p>\n<h3 style=\"color:#004a59;\">What Role the Model Gateway Plays in the New Topology<\/h3>\n<p>A topic often missing from the ongoing LMDeploy discussion: the role of the model gateway as an architectural layer. A model gateway (Kong AI Gateway, LiteLLM, Portkey, Vercel AI Gateway) ideally sits in front of the actual model server and handles authentication, rate\u2011limiting, PII filtering, and observability. For SSRF attacks the gateway adds another function: it can validate image URLs before forwarding them to the model server, filter private\u2011IP ranges, and enforce egress rules. Adding a gateway to the topology gives you a second defensive ring that operates independently of the model\u2011server code.<\/p>\n<p>Integrating a model gateway in a typical mid\u2011market setup costs between 30\u202f000 and 90\u202f000\u202fEuro in the first year (license, integration, operations training). The investment pays off mainly through two effects. First, the reduction of blast radius for model\u2011server vulnerabilities such as CVE\u20112026\u201133626. Second, unified observability across multiple model servers, which in heterogeneous environments would otherwise have to be built painstakingly per vendor. If you still don\u2019t have a model gateway in 2026, you should deploy one no later than Q3.<\/p>\n<h3 style=\"color:#004a59;\">What the Security Colleague from the App\u2011Dev World Says<\/h3>\n<p>A brief reality check from the field, from a cloud\u2011ops perspective: anyone who grew up in the app\u2011dev world knows SSRF from the OWASP Top\u202f10 for years. Classic countermeasures (URL validation, private\u2011IP blocking, DNS\u2011rebinding protection) are often available as middleware in web frameworks. In inference stacks of 2024 and 2025 this layer was frequently overlooked or labeled \u201cAI\u2011specific.\u201d The LMDeploy exploit shows that the app\u2011dev lessons apply to AI stacks unchanged, only with minor tweaks. When you ask your security organization to perform an SSRF review of all AI components, you typically receive a solid gap analysis within two weeks. That is the fastest ROI in the post\u2011LMDeploy week.<\/p>\n<h2 style=\"margin-top:64px;margin-bottom:20px;padding-top:16px;\">Frequently Asked Questions<\/h2>\n<details>\n<summary><strong>Which LMDeploy versions are affected?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The GitHub advisory lists all versions prior to the patched release. Specific version strings are found in the advisory and in the security trackers GitLab and NIST. Anyone running LMDeploy in production should immediately upgrade to the latest version and validate the load\u2011image path.<\/p>\n<\/details>\n<details>\n<summary><strong>Are other inference stacks similarly vulnerable?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Any inference stack with vision or multimodal capabilities and image\u2011loading functionality should be checked for SSRF risks. vLLM, Ray Serve and Text Generation Inference exhibit comparable functional patterns. An internal SSRF audit across the entire AI stack is warranted in 2026.<\/p>\n<\/details>\n<details>\n<summary><strong>Does a Web Application Firewall (WAF) help?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Only partially. WAF rules that block private\u2011IP ranges in HTTP bodies catch some attacks but often fall short, as attackers combine IPv6 private ranges, DNS rebinding and URL\u2011encoding. A WAF is a supplement, not a replacement for proper network segmentation and patch processes.<\/p>\n<\/details>\n<details>\n<summary><strong>What is the minimal detection strategy for this class of attacks?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Three signals prove reliable in practice: unusual egress destinations (169.254.*, 10.*, 172.16\u201131.*, 192.168.*), callback domains (requestrepo.com, oast.pro, burpcollaborator.net), and sudden latency spikes in model\u2011server logs caused by HTTP calls to unknown targets. Integrating these three signals into a SIEM or observability setup is a sprint\u2011level task.<\/p>\n<\/details>\n<details>\n<summary><strong>How does this relate to Zero\u2011Trust architectures?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Zero\u2011Trust architectures address the core of this attack cleanly: authenticate every connection, authorize every access, never assume trust at the network level. Organizations that implement Zero\u2011Trust consistently have structurally mitigated the LMDeploy exploit, because the inference server would not gain implicit rights on stateful back\u2011ends even in an SSRF scenario.<\/p>\n<\/details>\n<details>\n<summary><strong>Do we need to adjust our inference\u2011stack supplier contracts?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">For many companies, yes. The advisory\u2011to\u2011exploit window of 12.5\u202fhours means supplier SLAs with patch times of 30\u202fdays or more are untenable. Renegotiating to 72\u2011hour patches for critical vulnerabilities in AI\u2011stack components is appropriate in 2026. Failing to do so leaves a structural risk in production.<\/p>\n<\/details>\n<h3 style=\"color:#004a59;\">Network: Read more in cloudmagazin<\/h3>\n<ul>\n<li>Architectural classification of the <a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/a2a-protocol-1-2-in-production-what-dach-cloud-architects-need-to-change-in-their-istio-setup-now\/\">A2A Protocol 1.2 and Service Mesh integration<\/a><\/li>\n<li>Multi\u2011cloud view of <a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/24\/cloud-brokerage-services-2026-finops-report-dach-architects\/\">Cloud Brokerage Services and FinOps Report 21.04.2026<\/a><\/li>\n<li>Background on the <a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/24\/commvault-brings-clumio-to-google-cloud-storage-what-the\/\">Commvault\u2011Clumio push at Cloud Next 2026<\/a><\/li>\n<\/ul>\n<p style=\"text-align:right;\"><em>Source cover image: Pexels \/ Christina Morillo (px:1181263)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"LMDeploy-SSRF (CVE-2026-33626) was exploited within 12.5 hours. Three architectural consequences for cloud teams with vision-inference stacks.","protected":false},"author":31,"featured_media":36994,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["exploit-ssrf-vision-cloud-architecture"],"footnotes":""},"categories":[924,928],"tags":[],"industry":[],"class_list":["post-37128","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-artificial-intelligence","category-quantum-computing"],"evm_reading_time_minutes":12,"wpml_language":"en","wpml_translation_of":37004,"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>LMDeploy CVE-2026-33626: SSRF Lessons for AI Stacks<\/title>\n<meta name=\"description\" content=\"Sysdig 22.04.2026: LMDeploy-SSRF-Exploit within 12.5h. Three architecture lessons for Vision-LLM stacks: VPC, IMDSv2, Egress-Monitoring.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LMDeploy CVE-2026-33626: SSRF Lessons for AI Stacks\" \/>\n<meta property=\"og:description\" content=\"Sysdig 22.04.2026: LMDeploy-SSRF-Exploit within 12.5h. Three architecture lessons for Vision-LLM stacks: VPC, IMDSv2, Egress-Monitoring.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/\" \/>\n<meta property=\"og:site_name\" content=\"cloudmagazin\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cloudmagazincom\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-24T22:24:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-22T16:28:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/04\/cm-lmdeploy-260424.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1880\" \/>\n\t<meta property=\"og:image:height\" content=\"1255\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Alec Chizhik\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cloudmagazin\" \/>\n<meta name=\"twitter:site\" content=\"@cloudmagazin\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alec Chizhik\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/\"},\"author\":{\"name\":\"Alec Chizhik\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/person\\\/ce38baaa19a580268aedce096597eb3c\"},\"headline\":\"LMDeploy CVE-2026-33626: SSRF Lessons for AI Stacks\",\"datePublished\":\"2026-04-24T22:24:37+00:00\",\"dateModified\":\"2026-06-22T16:28:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/\"},\"wordCount\":2204,\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/cm-lmdeploy-260424.jpg\",\"articleSection\":[\"Artificial Intelligence\",\"Quantum Computing\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/\",\"name\":\"LMDeploy CVE-2026-33626: SSRF Lessons for AI Stacks\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/cm-lmdeploy-260424.jpg\",\"datePublished\":\"2026-04-24T22:24:37+00:00\",\"dateModified\":\"2026-06-22T16:28:19+00:00\",\"description\":\"Sysdig 22.04.2026: LMDeploy-SSRF-Exploit within 12.5h. Three architecture lessons for Vision-LLM stacks: VPC, IMDSv2, Egress-Monitoring.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/cm-lmdeploy-260424.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/cm-lmdeploy-260424.jpg\",\"width\":1880,\"height\":1255,\"caption\":\"Pexels \\\/ Christina Morillo (px:1181263)\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/2026\\\/04\\\/25\\\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/home\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"LMDeploy CVE-2026-33626: SSRF Lessons for AI Stacks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/\",\"name\":\"cloudmagazin\",\"description\":\"Inspiration f\u00fcr Businessentscheider\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#organization\",\"name\":\"cloudmagazin\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cloudmagazin-logo-klein_menu.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cloudmagazin-logo-klein_menu.jpg\",\"width\":150,\"height\":150,\"caption\":\"cloudmagazin\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cloudmagazincom\\\/\",\"https:\\\/\\\/x.com\\\/cloudmagazin\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/cloudmagazin\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/#\\\/schema\\\/person\\\/ce38baaa19a580268aedce096597eb3c\",\"name\":\"Alec Chizhik\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"contentUrl\":\"https:\\\/\\\/www.cloudmagazin.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/alec-chizhik.jpg\",\"caption\":\"Alec Chizhik\"},\"description\":\"Alec is the Chief Digital Officer at Evernine and writes about cloud architectures, IT security, and digital operations practices.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/alecchizhik\\\/\"],\"url\":\"https:\\\/\\\/www.cloudmagazin.com\\\/en\\\/author\\\/alec\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LMDeploy CVE-2026-33626: SSRF Lessons for AI Stacks","description":"Sysdig 22.04.2026: LMDeploy-SSRF-Exploit within 12.5h. Three architecture lessons for Vision-LLM stacks: VPC, IMDSv2, Egress-Monitoring.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/","og_locale":"en_US","og_type":"article","og_title":"LMDeploy CVE-2026-33626: SSRF Lessons for AI Stacks","og_description":"Sysdig 22.04.2026: LMDeploy-SSRF-Exploit within 12.5h. Three architecture lessons for Vision-LLM stacks: VPC, IMDSv2, Egress-Monitoring.","og_url":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/","og_site_name":"cloudmagazin","article_publisher":"https:\/\/www.facebook.com\/cloudmagazincom\/","article_published_time":"2026-04-24T22:24:37+00:00","article_modified_time":"2026-06-22T16:28:19+00:00","og_image":[{"width":1880,"height":1255,"url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/04\/cm-lmdeploy-260424.jpg","type":"image\/jpeg"}],"author":"Alec Chizhik","twitter_card":"summary_large_image","twitter_creator":"@cloudmagazin","twitter_site":"@cloudmagazin","twitter_misc":{"Written by":"Alec Chizhik","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/#article","isPartOf":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/"},"author":{"name":"Alec Chizhik","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/person\/ce38baaa19a580268aedce096597eb3c"},"headline":"LMDeploy CVE-2026-33626: SSRF Lessons for AI Stacks","datePublished":"2026-04-24T22:24:37+00:00","dateModified":"2026-06-22T16:28:19+00:00","mainEntityOfPage":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/"},"wordCount":2204,"publisher":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#organization"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/04\/cm-lmdeploy-260424.jpg","articleSection":["Artificial Intelligence","Quantum Computing"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/","url":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/","name":"LMDeploy CVE-2026-33626: SSRF Lessons for AI Stacks","isPartOf":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/#primaryimage"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/04\/cm-lmdeploy-260424.jpg","datePublished":"2026-04-24T22:24:37+00:00","dateModified":"2026-06-22T16:28:19+00:00","description":"Sysdig 22.04.2026: LMDeploy-SSRF-Exploit within 12.5h. Three architecture lessons for Vision-LLM stacks: VPC, IMDSv2, Egress-Monitoring.","breadcrumb":{"@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/#primaryimage","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/04\/cm-lmdeploy-260424.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/04\/cm-lmdeploy-260424.jpg","width":1880,"height":1255,"caption":"Pexels \/ Christina Morillo (px:1181263)"},{"@type":"BreadcrumbList","@id":"https:\/\/www.cloudmagazin.com\/en\/2026\/04\/25\/cve-2026-33626-lmdeploy-exploit-ai-stack-segmentation\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cloudmagazin.com\/en\/home\/"},{"@type":"ListItem","position":2,"name":"LMDeploy CVE-2026-33626: SSRF Lessons for AI Stacks"}]},{"@type":"WebSite","@id":"https:\/\/www.cloudmagazin.com\/en\/#website","url":"https:\/\/www.cloudmagazin.com\/en\/","name":"cloudmagazin","description":"Inspiration f\u00fcr Businessentscheider","publisher":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cloudmagazin.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.cloudmagazin.com\/en\/#organization","name":"cloudmagazin","url":"https:\/\/www.cloudmagazin.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2020\/04\/cloudmagazin-logo-klein_menu.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2020\/04\/cloudmagazin-logo-klein_menu.jpg","width":150,"height":150,"caption":"cloudmagazin"},"image":{"@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cloudmagazincom\/","https:\/\/x.com\/cloudmagazin","https:\/\/www.linkedin.com\/showcase\/cloudmagazin\/"]},{"@type":"Person","@id":"https:\/\/www.cloudmagazin.com\/en\/#\/schema\/person\/ce38baaa19a580268aedce096597eb3c","name":"Alec Chizhik","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","url":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","contentUrl":"https:\/\/www.cloudmagazin.com\/wp-content\/uploads\/2026\/03\/alec-chizhik.jpg","caption":"Alec Chizhik"},"description":"Alec is the Chief Digital Officer at Evernine and writes about cloud architectures, IT security, and digital operations practices.","sameAs":["https:\/\/www.linkedin.com\/in\/alecchizhik\/"],"url":"https:\/\/www.cloudmagazin.com\/en\/author\/alec\/"}]}},"_links":{"self":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/37128","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/users\/31"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/comments?post=37128"}],"version-history":[{"count":6,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/37128\/revisions"}],"predecessor-version":[{"id":47795,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/posts\/37128\/revisions\/47795"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/media\/36994"}],"wp:attachment":[{"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/media?parent=37128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/categories?post=37128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/tags?post=37128"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/www.cloudmagazin.com\/en\/wp-json\/wp\/v2\/industry?post=37128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}