Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: LMCache Clear all filters
TI-2026-69189 CVE-2026-107207 · GHSA-hrhp-726g-9jqc

SSRF allowlist bypass in LMCache frontend lacks authentication

Priority HIGH 70

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00289 Published 2026-10-07 No fix listed CWE-306
TI-2026-69188 CVE-2026-107206 · GHSA-3m4j-8j42-jwr9

Missing authentication in LMCache HTTP server exposes management API

Priority HIGH 77

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by defaul…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00584 Published 2026-10-07 No fix listed CWE-306
TI-2026-69187 CVE-2026-107205 · GHSA-87j8-jqhj-hfm7

Missing authentication in LMCache MP Coordinator fleet control API

Priority MEDIUM 44

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by defau…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00394 Published 2026-10-07 No fix listed CWE-306
TI-2026-69186 CVE-2026-107204 · GHSA-xgvf-x9rh-chj9

LMCache Unauthenticated RCE via /run_script Endpoint

Priority HIGH 81

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00768 Published 2026-10-07 No fix listed CWE-306
TI-2026-69101 CVE-2026-105192 · GHSA-vv44-hjm2-qw2f · GHSA-w5f2-9q9c-ff4h

Unauthenticated remote code execution in LMCache multiprocess mode

Priority MEDIUM 51

LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01024 Published 2026-10-07 Fixed in 0.5.6 CWE-306