Missing authentication in LMCache HTTP server exposes management API
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
LMCache through 0.5.5 contains a missing authentication flaw in its multiprocess mode HTTP server (CWE-306). The management endpoints listen on all interfaces by default and do not require authentication. A remote unauthenticated attacker can read environment credentials and configuration, clear caches, delete cache objects, and change tenant quotas to evict other tenants' cached data.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for LMCache.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-07 Threatist record created from CVE-2026-107206
- 2026-10-07 CISA SSVC decision points changed
- 2026-10-07 Priority changed: MEDIUM → HIGH
- 2026-10-07 Alias added: GHSA-3m4j-8j42-jwr9
References
Other 5
- GitHub Issue #5511
- https://github.com/LMCache/LMCache
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/config.py#L206
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/env_api.py#L13
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/quota_api.py#L138-L155
More LMCache vulnerabilities
- TI-2026-69186 LMCache Unauthenticated RCE via /run_script Endpoint CVSS 4.0CRITICAL 9.3
- TI-2026-69189 SSRF allowlist bypass in LMCache frontend lacks authentication CVSS 4.0MEDIUM 6.9
- TI-2026-69101 Unauthenticated remote code execution in LMCache multiprocess mode CVSS 3.1CRITICAL 9.8
- TI-2026-69187 Missing authentication in LMCache MP Coordinator fleet control API CVSS 4.0HIGH 8.8
Sources
- CVE-2026-107206 · CVE Program
- CVE-2026-107206 · NVD
- FIRST EPSS
- GHSA-3m4j-8j42-jwr9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences