CVE-2026-107206

Name of the Vulnerable Software and Affected Versions LMCache versions 0.5.5 and earlier

Description The multiprocess mode HTTP server lacks authentication, allowing remote unauthenticated attackers to access management endpoints that listen on all interfaces by default. This allows attackers to read environment credentials via the 'GET /env' endpoint and configuration via the 'GET /config' endpoint. Additionally, attackers can clear caches, delete cache objects, and modify tenant quotas to evict cached data belonging to other tenants.

Recommendations Update LMCache to a version later than 0.5.5.