LMCache: Unauthenticated remote code execution via /run_script endpoint
Summary
LMCache through version 0.5.5 contains an unauthenticated remote code execution vulnerability in its /run_script endpoint. An attacker with network access to the service can post a script that recovers real builtins through the injected FastAPI app object, bypasses the restricted __import__ function, imports os and runs operating system commands as the LMCache process. No authentication is required. CISA SSVC lists exploitation as proof-of-concept, but this is unverified.
Affected
- LMCache 0 through 0.5.5 (according to the CVE record and VulnCheck)
Fixed in
- Unknown. No fixed version is confirmed for this CVE.
Workaround
- Restrict or disable access to the /run_script endpoint at the application or network level.
- Place an authenticating API gateway in front of the service.
- Do not expose the service on a routable address.
Exploitation
- CISA SSVC: exploitation 'poc', automatable 'yes', technical impact 'total'.
- No evidence of exploitation in the wild was found.
- A public proof-of-concept is likely but unverified.
Our recommendation
- Check whether LMCache 0.5.5 or earlier is deployed, including inside vLLM setups.
- Remove public exposure of the service and restrict access to trusted hosts.
- Block or restrict POST requests to /run_script until a fix is confirmed.
- Monitor the LMCache process and logs for unexpected OS commands and script uploads.
- Track the upstream issue and advisories for a confirmed fixed version and apply it promptly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- LMCache GitHub repository github.com
- run_script_api.py at v0.5.5 github.com
- common_api.py at v0.5.5 github.com
- LMCache issue #5510 github.com
- VulnCheck advisory www.vulncheck.com
- OpenCVE CVE-2026-107204 app.opencve.io
- HOL Guard CVE-2026-107204 hol.org
- TheHackerWire CVE-2026-107204 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:04.
Original description (NVD)
LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process.
NVD references (6)
- https://github.com/LMCache/LMCache
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/run_script_api.py#L54-L76
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/common_api.py#L41-L46
- https://github.com/LMCache/LMCache/issues/5510
- https://www.vulncheck.com/advisories/lmcache-through-0.5.5-unauthenticated-rce-via-run-script-endpoint
- https://github.com/LMCache/LMCache/issues/5510
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.