---
id: CVE-2026-107206
title: >-
  LMCache through 0.5.5 contains a missing authentication vulnerability in the
  multiprocess mode HTTP server that allows remote unauthenticated attackers to
  access management endpoints listening on all interfaces by default
summary: >-
  LMCache through 0.5.5 contains a missing authentication vulnerability in the
  multiprocess mode HTTP server that allows remote unauthenticated attackers to
  access management endpoints listening on all interfaces by default. Attackers
  can …
severity: critical
cvss: 9.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H'
cwe:
  - CWE-306
vendor: LMCache
product: LMCache
affected:
  - LMCache <= 0.5.5
published: '2026-10-07'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T17:16:53.927'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107206'
references:
  - url: 'https://github.com/LMCache/LMCache'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/env_api.py#L13
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/config.py#L206
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/quota_api.py#L138-L155
    label: disclosure@vulncheck.com
  - url: 'https://github.com/LMCache/LMCache/issues/5511'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/lmcache-through-0.5.5-missing-authentication-in-mp-http-server-management-api
    label: disclosure@vulncheck.com
  - url: 'https://github.com/LMCache/LMCache/issues/5511'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-07T16:12:27.403304Z'
ingestedAt: '2026-10-07T16:38:22.225Z'
---

## Overview

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.