Read the docs
TI-2026-69189 Aliases CVE-2026-107207GHSA-hrhp-726g-9jqc

SSRF allowlist bypass in LMCache frontend lacks authentication

Priority HIGH 70CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

LMCache through 0.5.5 has a server-side request forgery flaw in its frontend monitoring service because it lacks authentication (CWE-306). An unauthenticated remote attacker can register arbitrary hosts in the proxy allowlist and then use the proxy to reach internal hosts, read their responses, and tamper with nodes or stop the heartbeat. The attack needs no privileges or user interaction and has low confidentiality and integrity impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach internal hosts, read responses, and tamper with nodes or stop the heartbeat.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LMCacheLMCacheup to 0.5.5—No fix listedCNA
  • LMCache VendorLMCache Affected up to 0.5.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for LMCache.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107207
  2. 2026-10-07 Alias added: GHSA-hrhp-726g-9jqc
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: MEDIUM → HIGH

References

Other 4

  • TI-2026-69186 LMCache Unauthenticated RCE via /run_script Endpoint CVSS 4.0CRITICAL 9.3
  • TI-2026-69188 Missing authentication in LMCache HTTP server exposes management API CVSS 4.0HIGH 8.8
  • TI-2026-69101 Unauthenticated remote code execution in LMCache multiprocess mode CVSS 3.1CRITICAL 9.8
  • TI-2026-69187 Missing authentication in LMCache MP Coordinator fleet control API CVSS 4.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences