Read the docs

LMCache

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

LMCache records in CISA KEV

No LMCache vulnerabilities are listed in CISA KEV.

Records

5 records

TI-2026-69186 CVE-2026-107204 · GHSA-xgvf-x9rh-chj9

LMCache Unauthenticated RCE via /run_script Endpoint

Priority HIGH 81

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00768 Published 2026-10-07 No fix listed CWE-306
TI-2026-69188 CVE-2026-107206 · GHSA-3m4j-8j42-jwr9

Missing authentication in LMCache HTTP server exposes management API

Priority HIGH 77

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by defaul…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00584 Published 2026-10-07 No fix listed CWE-306
TI-2026-69189 CVE-2026-107207 · GHSA-hrhp-726g-9jqc

SSRF allowlist bypass in LMCache frontend lacks authentication

Priority HIGH 70

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00289 Published 2026-10-07 No fix listed CWE-306
TI-2026-69101 CVE-2026-105192 · GHSA-vv44-hjm2-qw2f · GHSA-w5f2-9q9c-ff4h

Unauthenticated remote code execution in LMCache multiprocess mode

Priority MEDIUM 51

LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01024 Published 2026-10-07 Fixed in 0.5.6 CWE-306
TI-2026-69187 CVE-2026-107205 · GHSA-87j8-jqhj-hfm7

Missing authentication in LMCache MP Coordinator fleet control API

Priority MEDIUM 44

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by defau…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00394 Published 2026-10-07 No fix listed CWE-306
Open these records in search →