CVE-2026-107205
LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API
- State
- Published
- Severity
- 8.8 High
- Published
- Oct 7, 2026
- Updated
- Oct 7, 2026
- Reserved
- Oct 7, 2026
Description
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite quotas via /quota endpoints, inject events via /events, and enumerate /directory/keys to disrupt caching and disclose placement metadata.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.6 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
LMCacheLMCache |
|
References
- GitHub Issue #5508issue-tracking
- https://github.com/LMCache/LMCacheproduct
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/mp_coordinator/config.py#L71technical-description
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/mp_coordinator/app.py#L238-L246technical-description
- VulnCheck Advisory: LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control APIthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.