{"id":"CVE-2026-107206","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-107206","generatedAt":"2026-10-28T07:05:11.677Z","title":"LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default.","description":"LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.","published":"2026-10-07T16:17:45.000Z","lastModified":"2026-10-08T21:07:20.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.8,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-306"],"affected":[],"epss":{"score":0.00584,"percentile":0.47715,"date":"2026-10-27","history":[{"date":"2026-10-08","score":0.00584,"percentile":0.46221}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-07T16:17:45.000Z","detail":{"score":"8.8","severity":"HIGH","publishedAt":"2026-10-07T16:17:45.447Z"},"summary":"New CVE, high severity (CVSS 8.8)."}],"references":[{"url":"https://github.com/LMCache/LMCache","source":"disclosure@vulncheck.com"},{"url":"https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/env_api.py#L13","source":"disclosure@vulncheck.com"},{"url":"https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/config.py#L206","source":"disclosure@vulncheck.com"},{"url":"https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/quota_api.py#L138-L155","source":"disclosure@vulncheck.com"},{"url":"https://github.com/LMCache/LMCache/issues/5511","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lmcache-through-0.5.5-missing-authentication-in-mp-http-server-management-api","source":"disclosure@vulncheck.com"},{"url":"https://github.com/LMCache/LMCache/issues/5511","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-107206","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}