EUVD-2026-94385
GHSA-3m4j-8j42-jwr9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Default all-interface binding with no authentication gives AV:N/AC:L/PR:N/UI:N; credential disclosure yields C:H, cache/quota tampering I:L, and cache clearing/deletion A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.
AnalysisAI
LMCache through 0.5.5 ships a multiprocess-mode HTTP management/internal API server that binds to all network interfaces by default with no authentication, letting remote unauthenticated attackers reach management endpoints that should never be exposed. An attacker who can reach the management port can read process environment credentials via GET /env, read configuration via GET /config, clear or delete cached objects, and modify tenant quotas so that other tenants' cached data is evicted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable surface is LMCache's multiprocess-mode HTTP management/internal API server, which by default binds to all network interfaces (0.0.0.0) rather than loopback, exposing endpoints including GET /env, GET /config, cache-clear/delete operations, and tenant quota modification without any authentication (CWE-306, PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis: there is currently no tagged LMCache release or advisory-specified fix version that closes the missing authentication in the multiprocess HTTP management API, so operators on 0.5.5 and earlier should treat the default bind address as untrusted and isolate the service at the network layer while tracking https://github.com/LMCache/LMCache/issues/5511 and the VulnCheck advisory https://www.vulncheck.com/advisories/lmcache-through-0.5.5-missing-authentication-in-mp-http-server-management-api for a fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every LMCache deployment at version 0.5.5 or earlier, determine which instances run in multiprocess mode, and test whether the management port is reachable from outside the host; for any reachable instance, immediately bind the management interface to localhost or block the port at the host firewall and security-group level, and treat process environment secrets on those hosts as potentially disclosed by starting rotation of the highest-value credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in LMCache multiprocess (distributed) mode allows unauthenticated attackers to execute arbitrary c
Unauthenticated remote code execution in LMCache through 0.5.5 allows network-reachable attackers to execute arbitrary P
Remote unauthenticated attackers can disrupt and manipulate LMCache's multiprocess coordinator fleet control API in defa
Server-side request forgery in LMCache through 0.5.5 allows unauthenticated remote attackers to bypass the frontend moni
Weak hash truncation in LMCache up to 0.4.6 allows a local low-privilege attacker to induce KV cache collisions by explo
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today