CVE-2026-107204CWE-306

CVE-2026-107204

Critical · published October 7, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
55.1
In the wild
Unconfirmed
What it is

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00768 · 55.1th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-10-07T20:17Z
References (6)
https://github.com/LMCache/LMCache · [email protected]https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/run_script_api.py#L54-L76 · [email protected]https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/common_api.py#L41-L46 · [email protected]https://github.com/LMCache/LMCache/issues/5510 · [email protected]https://www.vulncheck.com/advisories/lmcache-through-0.5.5-unauthenticated-rce-via-run-script-endpoint · [email protected]https://github.com/LMCache/LMCache/issues/5510 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 1%
    epss
  • 07 OCT 15:24Z
    LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint
    cvelistv5