{"id":"CVE-2026-107206","published":"2026-10-07T16:17:45.447","lastModified":"2026-10-08T21:07:19.997","description":"LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.","cvssScore":9.4,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/LMCache/LMCache","tags":[]},{"url":"https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/env_api.py#L13","tags":[]},{"url":"https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/config.py#L206","tags":[]},{"url":"https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/quota_api.py#L138-L155","tags":[]},{"url":"https://github.com/LMCache/LMCache/issues/5511","tags":[]},{"url":"https://www.vulncheck.com/advisories/lmcache-through-0.5.5-missing-authentication-in-mp-http-server-management-api","tags":[]},{"url":"https://github.com/LMCache/LMCache/issues/5511","tags":[]}],"exploitRefs":[{"url":"https://github.com/LMCache/LMCache","tags":[]},{"url":"https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/env_api.py#L13","tags":[]},{"url":"https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/config.py#L206","tags":[]},{"url":"https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/quota_api.py#L138-L155","tags":[]},{"url":"https://github.com/LMCache/LMCache/issues/5511","tags":[]},{"url":"https://github.com/LMCache/LMCache/issues/5511","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw is a missing authentication vulnerability in the multiprocess mode HTTP server of LMCache, allowing unauthenticated attackers to access sensitive endpoints and perform various operations, including reading environment credentials and modifying tenant quotas.","exploitability":"Exploitation is relatively straightforward as the management endpoints are accessible by default on all interfaces, requiring no specific user interaction.","blast_radius":"If exploited, attackers can read sensitive information, modify configurations, and evict cached data from other tenants, leading to potential data leakage and service disruptions.","remediation":"Upgrade to LMCache 0.5.6 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","rce","config-exposure"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:40:57.786Z"}}