Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

LMCache up to 0.5.5 lets anyone change settings

CVE-2026-107206 · published 3 days ago
Summary

The LMCache service (versions through 0.5.5) runs a web interface that does not require a login, and it listens on all network addresses by default. Because of this, anyone on the network can view environment details, read configuration, clear or delete cached data, and alter tenant quotas, potentially disrupting other users. Update to a newer version or restrict the server to trusted networks and add proper authentication.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
lmcache lmcache <= 0.5.5
Original advisory text
LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published7 Oct 2026
Updated9 Oct 2026
First seen7 Oct 2026
Sources
CVE-2026-107206 · NVD
CVE-2026-107206 · MITRE
CVE-2026-107206 · OSV
Track software like this
Free during beta