CRITICAL 9.3 NVD
CVE-2026-107204
LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to
LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process.
References
- https://github.com/LMCache/LMCache
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/run_s
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/common_ap
- https://github.com/LMCache/LMCache/issues/5510
- https://www.vulncheck.com/advisories/lmcache-through-0.5.5-unauthenticated-rce-via-run-scr
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-07 via NVD.
Risk Timeline
CVE Disclosed2026-10-07 · 4 days ago
Remediation Resources
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.