CVE-2026-107205

Name of the Vulnerable Software and Affected Versions LMCache versions 0.5.5 and earlier

Description The multiprocess coordinator lacks authentication, allowing remote unauthenticated attackers to access the HTTP fleet control API, which listens on all interfaces by default. Attackers can use the '/instances' endpoint to register or deregister instances, the '/quota' endpoint to overwrite quotas, and the '/events' endpoint to inject events. Additionally, they can enumerate '/directory/keys' to disclose placement metadata and disrupt caching.

Recommendations Update LMCache to a version later than 0.5.5. Restrict access to the HTTP fleet control API to prevent unauthorized remote access.