Read the docs
TI-2026-69187 Aliases CVE-2026-107205GHSA-87j8-jqhj-hfm7

Missing authentication in LMCache MP Coordinator fleet control API

Priority MEDIUM 44CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

LMCache through 0.5.5 has a missing authentication flaw in its multiprocess coordinator, where the HTTP fleet control API listens on all interfaces by default (CWE-306). A remote unauthenticated attacker can register or deregister instances, overwrite quotas, inject events, and enumerate directory keys, which disrupts caching and discloses placement metadata.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite quotas via /quota endpoints, inject events via /events, and enumerate /directory/keys to disrupt caching and disclose placement metadata.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LMCacheLMCacheup to 0.5.5—No fix listedCNA
  • LMCache VendorLMCache Affected up to 0.5.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for LMCache.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107205
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Alias added: GHSA-87j8-jqhj-hfm7

References

Other 4

  • TI-2026-69186 LMCache Unauthenticated RCE via /run_script Endpoint CVSS 4.0CRITICAL 9.3
  • TI-2026-69188 Missing authentication in LMCache HTTP server exposes management API CVSS 4.0HIGH 8.8
  • TI-2026-69189 SSRF allowlist bypass in LMCache frontend lacks authentication CVSS 4.0MEDIUM 6.9
  • TI-2026-69101 Unauthenticated remote code execution in LMCache multiprocess mode CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences