CVE-2026-107205 in LMCache
Summary
by MITRE • 10/07/2026
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite quotas via /quota endpoints, inject events via /events, and enumerate /directory/keys to disrupt caching and disclose placement metadata.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
LMCache versions through 0.5.5 suffer from a critical missing authentication vulnerability within its multiprocess coordinator component. This flaw stems from the default configuration of the HTTP fleet control API, which listens on all network interfaces without requiring any form of credential verification or access control checks. Consequently, remote unauthenticated attackers can interact directly with sensitive administrative endpoints exposed over the network. The absence of an authentication mechanism means that any entity capable of reaching the host machine's IP address and port can execute commands intended only for trusted internal processes or administrators, fundamentally breaking the security boundary between external actors and the cache management system.
The operational impact of this vulnerability is severe due to the breadth of actions available through exposed endpoints. Attackers can register new instances or deregister existing ones via the /instances endpoint, effectively manipulating the cluster topology and potentially causing denial of service by removing critical nodes from the fleet. Furthermore, the ability to overwrite quotas using the /quota endpoint allows attackers to exhaust system resources or starve legitimate services of cache capacity, leading to performance degradation or complete service unavailability. The injection of arbitrary events through the /events endpoint introduces further instability, as these events may trigger unintended state changes within the caching logic, potentially corrupting data consistency across the distributed system.
Beyond availability and integrity concerns, this vulnerability poses a significant risk to confidentiality. Attackers can enumerate keys in the /directory/keys endpoint, which discloses placement metadata regarding where specific cache entries are stored. This information leakage aids attackers in mapping the internal architecture of the deployment, identifying high-value targets for subsequent attacks such as cache poisoning or targeted data exfiltration if other vulnerabilities exist within the application layer consuming these cached items. The combination of administrative control and informational disclosure creates a comprehensive attack vector that can compromise the entire caching infrastructure's reliability and security posture.
From an industry standard perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to adequately verify identity before granting access to sensitive functions. It also relates to CWE-601 URL Redirection to Untrusted Site or Resource if misconfigured redirects are involved in the fleet management logic, though primarily it is an authentication failure. In terms of MITRE ATT&CK tactics, this maps directly to Initial Access via T1190 Exploit Public-Facing Application and Privilege Escalation via T1078 Valid Accounts if the attacker leverages stolen credentials from other services that share trust boundaries with LMCache. The ability to modify cluster state corresponds to Defense Evasion or Impact tactics, specifically disrupting availability through resource exhaustion or service disruption techniques found in the Impact tactic group.
Mitigation strategies must prioritize immediate network-level isolation and configuration hardening. Administrators should restrict access to the HTTP fleet control API by binding it exclusively to localhost (127.0.0.1) if remote management is not strictly required, thereby preventing external network reachability. If remote administration is necessary, implementing strong authentication mechanisms such as OAuth 2.0 or mutual TLS is essential to ensure that only authorized clients can interact with the coordinator endpoints. Additionally, deploying a reverse proxy with strict access control lists (ACLs) in front of LMCache can provide an additional layer of defense by filtering unauthorized requests before they reach the application logic. Regular security audits and penetration testing should be conducted to identify similar misconfigurations in other distributed caching systems that may share architectural similarities.