CVE-2026-107205
Received Received - Intake

LMCache Missing Authentication in Multiprocess Coordinator

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: VulnCheck

Description
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite quotas via /quota endpoints, inject events via /events, and enumerate /directory/keys to disrupt caching and disclose placement metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-107205
EUVD
EUVD-2026-94384

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LMCache LMCache 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-107205 is a missing authentication vulnerability in LMCache versions up to 0.5.5. The MP Coordinator Fleet Control API listens on all network interfaces by default without requiring authentication. This allows remote attackers to interact with the API and perform unauthorized actions such as registering or deregistering cache instances, modifying quotas, injecting events, and enumerating directory keys.

Detection Guidance

Check if the LMCache MP Coordinator is running on default ports 9300 or 9000 without authentication. Use network scanning tools like nmap to detect open ports and services. Example command: nmap -p 9300,9000 -sV <target-ip>. Inspect HTTP responses from these ports for unauthenticated endpoints like /instances, /quota, /events, or /directory/keys.

Impact Analysis

An attacker could exploit this to disrupt caching operations, remove legitimate cache instances from scheduling, manipulate tenant quotas, inject false cache events, or access sensitive placement metadata. This could lead to cache unavailability, incorrect data placement, quota violations, and exposure of internal system details.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Exposure of placement metadata or directory keys may result in non-compliance with confidentiality and integrity controls mandated by these regulations.

Mitigation Strategies

Immediately restrict network access to ports 9300 and 9000 using firewalls or network policies. Disable the MP Coordinator if not required. Monitor for unauthorized API calls to endpoints like /instances or /quota. Update to a patched version once available. If no patch exists, consider isolating the service from untrusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107205. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart