CVE-2026-107205

8.6 HIGHpublic exploit available

Published 2026-10-07 · Updated 2026-10-08

AI risk analysis

Summary: The flaw is a missing authentication vulnerability in the multiprocess coordinator of LMCache, allowing unauthenticated attackers to access and manipulate the HTTP fleet control API. This can lead to disruption of caching and disclosure of placement metadata.
Exploitability: Exploitation is relatively straightforward as the API listens on all interfaces by default, requiring no specific user interaction other than network access.
Blast radius: If exploited, the impact could be significant, including disruption of services and potential disclosure of sensitive metadata.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to LMCache 0.5.6 or later.

auth-bypassapiweb

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite quotas via /quota endpoints, inject events via /events, and enumerate /directory/keys to disrupt caching and disclose placement metadata.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weaknesses

CWE-306

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.