Critical severity · published Oct 7, 2026
CVE-2026-107206
LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API
9.4
CVSS
0.6%
EPSS
No
On KEV
Description
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LM
LMCache · LMCache
through 0.5.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107206
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107206
issue-tracking
https://github.com/LMCache/LMCache/issues/5511
product
https://github.com/LMCache/LMCache
technical-description
https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/config.py#L206
technical-description
https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/env_api.py#L13
technical-description
https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/quota_api.py#L138-L155
third-party-advisory
https://www.vulncheck.com/advisories/lmcache-through-0.5.5-missing-authentication-in-mp-http-server-management-api
More from LMCache
9.8
CVE-2026-107204
LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint
9.8
CVE-2026-105192
LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization
8.6
CVE-2026-107205
LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API
7.2
CVE-2026-107207
LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass
3.6
CVE-2026-10813
LMCache KV Cache utils.py hex_hash_to_int16 weak hash