Vulnerability · Published Oct 7, 2026 · Assigned by VulnCheck

CVE-2026-107206LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API

Critical 9.4

In plain English

A critical-severity missing authentication in LMCache from LMCache. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)9.4Critical

Exploit odds (30 days)0.6%top 51.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.

Affected products (as reported)

Vendor	Product	Versions
LMCache	LMCache	0 – through 0.5.5

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

References

GitHub Issue #5511 issue-tracking
https://github.com/LMCache/LMCache product
https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/config.py#L206 technical-description
https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/env_api.py#L13 technical-description
https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/quota_api.py#L138-L155 technical-description
VulnCheck Advisory: LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API third-party-advisory