EUVD-2026-94386
GHSA-hrhp-726g-9jqc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SSRF (AV:N/AC:L/PR:N/UI:N) that reaches other internal systems warrants S:C; impact is limited reads and tampering (C:L/I:L) with no stated availability loss (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach internal hosts, read responses, and tamper with nodes or stop the heartbeat.
AnalysisAI
Server-side request forgery in LMCache through 0.5.5 allows unauthenticated remote attackers to bypass the frontend monitoring service's proxy allowlist by registering arbitrary host entries through POST /api/proxies, then relaying requests to internal systems via /proxy or /proxy2 and reading the responses back. Successful abuse also permits tampering with catalogued nodes and stopping the heartbeat mechanism, but the impact is bounded to limited information disclosure, limited integrity impact, and availability disruption rather than full host takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the LMCache frontend monitoring service (the proxy/node-catalog feature) at or before version 0.5.5; the vulnerable endpoints are POST /api/proxies for host registration and /proxy and /proxy2 for the relayed requests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority issue rather than a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - none of the supplied references (including the upstream GitHub issue 5512 and the VulnCheck advisory) point to a fixed release version, so verify the issue tracker and project releases before assuming a patched build exists. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in LMCache multiprocess (distributed) mode allows unauthenticated attackers to execute arbitrary c
Unauthenticated remote code execution in LMCache through 0.5.5 allows network-reachable attackers to execute arbitrary P
LMCache through 0.5.5 ships a multiprocess-mode HTTP management/internal API server that binds to all network interfaces
Remote unauthenticated attackers can disrupt and manipulate LMCache's multiprocess coordinator fleet control API in defa
Weak hash truncation in LMCache up to 0.4.6 allows a local low-privilege attacker to induce KV cache collisions by explo
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today