CVE-2026-107204 in LMCache
Summary
by MITRE • 10/07/2026
LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in LMCache versions up to 0.5.5 represents a critical unauthenticated remote code execution flaw that fundamentally compromises the integrity of the application environment. This security defect is located within the /run_script endpoint, which was designed to facilitate dynamic script execution but lacks any form of authentication or access control mechanisms. Consequently, any external actor with network connectivity to the LMCache service can interact directly with this interface without providing credentials, establishing a direct attack vector for malicious actors seeking full system compromise.
The technical root cause lies in how the application handles user-supplied Python code within an injected FastAPI application object. The developers implemented safeguards intended to restrict dangerous operations by guarding the _import_ function, presumably to prevent arbitrary module loading. However, attackers can bypass these restrictions through a technique known as builtins recovery. By accessing the global namespace of the injected FastAPI app object, it is possible to retrieve references to Python's real built-in modules and functions that were not properly sandboxed or restricted. This allows the attacker to import critical standard library modules such as os, which provides direct access to operating system commands.
Once the os module is successfully imported via this bypass mechanism, the attacker gains the ability to execute arbitrary shell commands with the same privileges as the LMCache process itself. This escalation from script execution to full remote code execution means that an adversary can perform a wide range of malicious activities including data exfiltration, lateral movement within the network, installation of persistent backdoors, or complete destruction of system resources. The severity is exacerbated by the fact that no authentication is required, making this vulnerability easily exploitable by automated scanning tools and opportunistic attackers alike.
From an industry standards perspective, this flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it involves the execution of user-controlled code within a server-side context. Furthermore, the exploitation technique maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing system commands via Python scripts, and potentially T1621 Ability to Access Built-in Functions if considering the bypass mechanism itself. The lack of authentication also relates to CWE-306 Missing Authentication for Critical Function, highlighting a fundamental failure in access control design.
To mitigate this vulnerability, organizations running LMCache versions prior to 0.5.6 must immediately upgrade to the patched version where these security controls have been strengthened. In environments where upgrading is not immediately feasible, network-level mitigations should be implemented to restrict access to the /run_script endpoint exclusively from trusted internal sources if such functionality is strictly required for legitimate operations. Ideally, this endpoint should be disabled entirely in production environments unless absolutely necessary, as dynamic script execution poses inherent risks that are difficult to fully mitigate through input validation alone. Regular security audits and penetration testing focused on API endpoints can help identify similar misconfigurations before they are exploited by adversaries.