PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107205 LMCache CVE debrief

CVE-2026-107205: LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator fleet control API. This allows remote unauthenticated attackers to access and manipulate caching and metadata, potentially disrupting operations and disclosing sensitive information. The vulnerability is highly severe with a CVSS score of 8.8. Defenders should assess exposure and potential impacts, especially for instances with publicly accessible fleet control APIs. The CVE record was published on 2026-10-07T15:24:04.028Z and has not been modified since then. Additional information on potential exploitation, impact, or remediation is limited.

Vendor
LMCache
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-07
Original CVE updated
2026-10-07
Advisory published
2026-10-07
Advisory updated
2026-10-07

Who should care

Defenders responsible for LMCache instances, especially those with publicly accessible fleet control APIs, should assess exposure and potential impacts. This includes verifying the exposure of instances, reviewing potential impacts on caching and metadata disclosure, and planning for updates or mitigations. Security teams and vulnerability management teams should also review the vulnerability and assess the risk to their environments. Operators of LMCache,

Why it matters

Defenders should prioritize verifying exposure of LMCache instances, especially those with publicly accessible fleet control APIs, and assess potential impacts on caching and metadata disclosure. The vulnerability allows remote unauthenticated attackers to access and manipulate caching and metadata, potentially disrupting operations and disclosing sensitive information.

  • Potential disruption of caching operations
  • Possible disclosure of placement metadata
  • Risk of unauthorized instance registration or deregistration
  • Quota overwrites via /quota endpoints

Technical summary

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator fleet control API. This allows remote unauthenticated attackers to access and manipulate caching and metadata. The vulnerability is highly severe with a CVSS score of 8.8. The multiprocess coordinator fleet control API listens on all interfaces by default, allowing attackers to register or deregister instances via /instances, overwrite quotas via /quota endpoints, inject events via /events, and enumerate /directory/keys. Defenders should prioritize verifying exposure of LMCache instances, especially those with publicly accessible fleet control APIs, and assess potential impacts on caching and metadata. The CVE-

Defensive priority

Defenders should prioritize verifying exposure of LMCache instances, especially those with publicly accessible fleet control APIs, and assess potential impacts on caching and metadata disclosure.

Recommended defensive actions

  • Verify LMCache instance exposure, especially those with publicly accessible fleet control APIs
  • Assess potential impacts on caching and metadata disclosure
  • Review and update LMCache to version 0.5.6 or later if available
  • Monitor fleet control API for suspicious activity
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the missing authentication vulnerability in LMCache's multiprocess coordinator fleet control API. However, additional information on potential exploitation, impact, or remediation is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107205 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107205

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107205 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107205

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107205.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/LMCache/LMCache/issues/5508

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/LMCache/LMCache

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/mp_coordinator/config.py

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/mp_coordinator/app.py

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/lmcache-through-0.5.5-missing-authentication-in-mp-coordinator-fleet-control-api

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.