EUVD-2026-94384
GHSA-87j8-jqhj-hfm7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Default all-interfaces binding with no auth gives AV:N/AC:L/PR:N/UI:N; metadata disclosure is C:L, quota/event injection is I:L, and instance deregistration disrupting caching is A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite quotas via /quota endpoints, inject events via /events, and enumerate /directory/keys to disrupt caching and disclose placement metadata.
AnalysisAI
Remote unauthenticated attackers can disrupt and manipulate LMCache's multiprocess coordinator fleet control API in default deployments through 0.5.5, using the /instances, /quota, /events, and /directory/keys endpoints to deregister instances, overwrite quotas, inject events, and disclose placement metadata. The independent assessment confirms that the only material barrier is network reachability because the API binds to all interfaces with no authentication (PR:N) and no user interaction, resulting in low confidentiality and integrity impact and high availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the LMCache multiprocess coordinator's HTTP fleet control API, which by default binds to all interfaces (0.0.0.0) with no authentication - so against a default deployment of LMCache (through 0.5.5) a remote unauthenticated attacker can directly invoke the /instances, /quota, /events, and /directory/keys endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, actionable priority rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is specified in the supplied references; track the upstream issue at https://github.com/LMCache/LMCache/issues/5508 and the VulnCheck advisory at https://www.vulncheck.com/advisories/lmcache-through-0.5.5-missing-authentication-in-mp-coordinator-fleet-control-api for a fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all LMCache deployments, confirm whether any run versions through 0.5.5 with the multiprocess coordinator fleet control API exposed, and immediately restrict reachability to the /instances, /quota, /events, and /directory/keys endpoints using host firewalls, security groups, or network ACLs; if possible, bind the API to localhost or a trusted management network only and place an authenticating reverse proxy in front of it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in LMCache multiprocess (distributed) mode allows unauthenticated attackers to execute arbitrary c
Unauthenticated remote code execution in LMCache through 0.5.5 allows network-reachable attackers to execute arbitrary P
LMCache through 0.5.5 ships a multiprocess-mode HTTP management/internal API server that binds to all network interfaces
Server-side request forgery in LMCache through 0.5.5 allows unauthenticated remote attackers to bypass the frontend moni
Weak hash truncation in LMCache up to 0.4.6 allows a local low-privilege attacker to induce KV cache collisions by explo
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today