CVE-2026-107206

Summary

The flaw is a missing authentication vulnerability in the multiprocess mode HTTP server of LMCache, allowing unauthenticated attackers to access sensitive endpoints and perform various operations, including reading environment credentials and modifying tenant quotas.

Exploitability

Exploitation is relatively straightforward as the management endpoints are accessible by default on all interfaces, requiring no specific user interaction.

Blast radius

If exploited, attackers can read sensitive information, modify configurations, and evict cached data from other tenants, leading to potential data leakage and service disruptions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to LMCache 0.5.6 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.