LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers… (CVE-2026-107207)

CVE-2026-107207 describes an SSRF vulnerability in LMCache up to version 0.5.5. The vulnerability exists in the frontend monitoring service where unauthenticated attackers can add arbitrary hosts to the proxy allowlist through the /api/proxies POST endpoint. This bypass enables attackers to leverage the /proxy and /proxy2 endpoints to reach internal network hosts, potentially reading sensitive data and disrupting node functionality or heartbeat mechanisms.

The vulnerability allows unauthenticated remote attackers to bypass proxy restrictions and access internal network resources. This can lead to information disclosure (reading internal host responses) and integrity issues by tampering with nodes or stopping heartbeat signals. The CVSS score of 7.2 (medium severity) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity with no availability impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the frontend monitoring service endpoints and monitor for suspicious POST requests to /api/proxies. Consider network-level controls to limit exposure of internal hosts accessible via /proxy and /proxy2 endpoints.