LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers… (CVE-2026-107205)

LMCache through version 0.5.5 contains a missing authentication vulnerability in its multiprocess coordinator component. The HTTP fleet control API, exposed on all interfaces by default, lacks authentication controls, enabling remote unauthenticated attackers to perform unauthorized actions. These actions include registering or deregistering instances via the /instances endpoint, overwriting quotas via /quota endpoints, injecting events via /events, and enumerating keys via /directory/keys. Such unauthorized access can disrupt caching functionality and disclose sensitive placement metadata.

The vulnerability allows remote attackers without authentication to access and manipulate the HTTP fleet control API. This can lead to disruption of caching services through unauthorized instance management and quota modifications. Additionally, attackers can inject events and enumerate directory keys, potentially disclosing sensitive metadata related to cache placement. The CVSS score of 8.6 indicates a high severity impact with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the HTTP fleet control API to trusted hosts only and consider implementing external access controls or network segmentation to limit exposure.