CVE-2026-107207

Name of the Vulnerable Software and Affected Versions LMCache versions 0.5.5 and earlier

Description The frontend monitoring service contains a server-side request forgery (SSRF) issue. Unauthenticated attackers can bypass the proxy allowlist by registering arbitrary hosts through the 'POST /api/proxies' endpoint. Subsequently, the '/proxy' or '/proxy2' endpoints can be used to access internal hosts, read responses, tamper with nodes, or stop the heartbeat.

Recommendations Update LMCache to a version later than 0.5.5. Restrict access to the 'POST /api/proxies', '/proxy', and '/proxy2' endpoints to minimize the risk of exploitation.