CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-107206 — LMCache through 0.5.5 contains a missing authentication vulnerability in the mul...

·Source: NIST NVD

Updated:

Executive Summary

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' c

Analysis

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data. CVSS Score: 9.4. Published: 2026-10-07T16:17:45.447.

Indicators of Compromise (1)

CVE (1)
CVE-2026-107206
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 7, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Hackers hijack Google domains after breaching ccTLD registries

Hackers obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana, American Samoa, and Sierra Leone after compromising third-party operators and modifying authoritative DNS records. [...]

BleepingComputer
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-107161 — A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge(...

A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-

CVE-2026-107161
NIST NVD
MEDIUMVulnerability

US posts $10 million reward for accused Chinese ‘Hafnium’ hacker

U.S. officials say Zhang Yu was a prominent figure in the Hafnium campaign, which saw hackers breach thousands of computers and steal troves of documents.

The Record