CVE-2026-107206

EUVD-2026-94385
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.4 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 46.22%
Common Weakness Enumeration
References
https://github.com/LMCache/LMCache
https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/env_api.py#L13
https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/config.py#L206
https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/quota_api.py#L138-L155
https://github.com/LMCache/LMCache/issues/5511
https://www.vulncheck.com/advisories/lmcache-through-0.5.5-missing-authentication-in-mp-http-server-management-api
https://github.com/LMCache/LMCache/issues/5511