LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated… (CVE-2026-107206)

LMCache through version 0.5.5 contains a missing authentication vulnerability (CWE-306) in its multiprocess mode HTTP server. The server listens on all interfaces by default without requiring authentication, enabling remote unauthenticated attackers to access management endpoints. Exploitation allows reading environment credentials via the GET /env endpoint and configuration via GET /config. Additionally, attackers can clear caches, delete cache objects, and alter tenant quotas to evict cached data of other tenants. The CVSS v3.1 base score is 9.4, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and availability impacts.

Remote unauthenticated attackers can access sensitive management endpoints, leading to disclosure of environment credentials and configuration data. They can also disrupt cache operations by clearing caches, deleting cache objects, and modifying tenant quotas, potentially evicting other tenants' cached data. This compromises confidentiality and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the multiprocess mode HTTP server management endpoints to trusted hosts only. Implement network-level controls such as firewall rules to prevent unauthorized access. Monitor for unusual activity related to cache management endpoints.