Vulnerability · Published Oct 7, 2026 · Assigned by VulnCheck

CVE-2026-107205LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

High 8.6

In plain English

A high-severity missing authentication in LMCache from LMCache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.4%top 66.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite quotas via /quota endpoints, inject events via /events, and enumerate /directory/keys to disrupt caching and disclose placement metadata.

Affected products (as reported)

Vendor	Product	Versions
LMCache	LMCache	0 – through 0.5.5

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References

GitHub Issue #5508 issue-tracking
https://github.com/LMCache/LMCache product
https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/mp_coordinator/config.py#L71 technical-description
https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/mp_coordinator/app.py#L238-L246 technical-description
VulnCheck Advisory: LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API third-party-advisory