plaincve:~$

// threat brief

CVE-2026-107204

LMCache /run_script unauthenticated remote code execution: anyone who can reach the admin port can run Python

CVSS
9.8 CRITICAL
CISA KEV
Not listed
Weakness
CWE-306
Topics
AI security · Infrastructure

PlainCVE Team · Published 2026-10-12 · Updated 2026-10-12 · AI-assisted · Press brief ↓

AI review 2026-10-12 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

LMCache through 0.5.5 runs any Python sent to its /run_script admin endpoint without auth; no stable fix, prereleases 0.5.6rc2/rc3 only disable it by default.

Who is affectedDeployments of the PyPI package lmcache at version 0.5.5 or earlier whose admin HTTP port can be reached from other machines. Per the v0.5.5 source, the standalone lmcache server HTTP frontend binds 0.0.0.0 on port 8080 by default and always serves /run_script; the internal API server embedded in vLLM is off by default and, once enabled, binds 0.0.0.0 with ports starting at 6999. Unconfirmed: the PoC environment in issue #5510 (that page contains exploit code; PlainCVE does not link to it) additionally installed python-multipart, which is not in lmcache 0.5.5's requires_dist on PyPI, so whether a default install is always exploitable has not been confirmed. PlainCVE note: the PR #5129 author points out that lmcache_frontend on the same host binds 0.0.0.0 by default with no authentication, so the admin API may still be reachable remotely.
What happensAn attacker can run Python code inside the LMCache process and, after getting around an import guard, run operating system commands with the server's privileges. A reporter says that on GPU inference hosts this is typically root, and environment variables such as cloud credentials and HF tokens may be exposed.
What to do nowThere is no stable fixed release and no LMCache security advisory; the following is PlainCVE's advice. Make sure the admin port (8080 by default for the standalone lmcache server; from 6999 for the internal API server) is not exposed; restrict outside access with a firewall (advice from a third-party security news site, not an official advisory), and bind the admin servers to 127.0.0.1 (proposed in issue #5128 and made the default by PR #5129). PlainCVE note: binding to 127.0.0.1 alone is not enough. The PR #5129 author points out that lmcache_frontend on the same host binds 0.0.0.0 by default with no authentication, so the admin API may still be reachable through it; check the frontend too. The hardening change PR #5129 was merged on 2026-09-23 and is in pre-releases 0.5.6rc2 and 0.5.6rc3; it only turns /run_script off by default and does not add authentication, so if run_script_api_enabled is turned on and the admin port is reachable from other machines, the endpoint still allows remote code execution.
Affected versionsAll versions up to and including 0.5.5
Fixed versionsNo stable fixed release yet (as of 2026-10-07); pre-releases 0.5.6rc2 and 0.5.6rc3 disable /run_script by default but add no authentication
CVSS vector
Show full vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
  • First public 2026-09-15

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check your version

    All lmcache versions up to and including 0.5.5 fall in the CVE record's affected range. Where to run: on the host running LMCache, inside the Python virtual environment or container LMCache is installed in (for example, activate that venv first or use docker exec to enter the container). Run in a different Python environment, it will find nothing or the wrong version; finding nothing does not mean it isn't installed.

    Read-only check
    pip show lmcache | grep -i '^version'
  2. 02Check whether the admin port listens externally

    Per the v0.5.5 source, the standalone lmcache server HTTP frontend binds 0.0.0.0:8080 by default; the internal API server, once enabled, binds 0.0.0.0 with ports starting at 6999 (possibly extending to 7000 and above). This read-only command lists listeners on those ports; if you changed the ports, use your own settings, or filter by the lmcache process name instead (-p may need root to show process info). If the listen address is 0.0.0.0 rather than 127.0.0.1, other machines may be able to reach it. Where to run: on the host running LMCache; for container deployments, inside that container or its network namespace (for example docker exec into the container, or nsenter into its network namespace from the host). This command does not cover lmcache_frontend: the PR #5129 author points out the frontend also binds 0.0.0.0 by default with no authentication; we found no source for its default port, so check its listening port separately based on how you start it.

    Read-only check
    ss -tlnp | grep -E ':(8080|69[0-9]{2}|7[0-9]{3})[[:space:]]'
    Step 1
  3. 03Search logs for requests to /run_script

    A security news site suggests looking in logs for unauthenticated POST requests to /run_script. If you never use this feature, any such request is worth investigating. Note that we found no source saying whether LMCache writes an HTTP access log by default, where it goes, or what format it uses; the folder path below is a placeholder, so change it to the folder where your deployment actually keeps logs (for example reverse-proxy or uvicorn logs). Finding nothing does not prove nothing happened. Where to run: on the host that stores the LMCache or front reverse-proxy logs (or on your log server if logs are collected centrally). This PlainCVE command only reads files, and -r searches subfolders; rotated .gz logs are not read by grep, so search them separately with zgrep.

    Read-only check
    grep -rn 'POST /run_script' /path/to/logs/
    Step 2
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Block outside access to LMCache

    Until a stable fixed release is available, a security news site advises using firewall rules or access control lists (ACLs) to restrict direct outside access to LMCache. This is third-party advice, not an official advisory.

    Step 1
  2. 02Bind the admin servers to localhost

    Issue #5128 proposes setting internal_api_server_host and --http-host to 127.0.0.1, and PR #5129 makes that the default (the 0.5.6rc2 and 0.5.6rc3 source already uses 127.0.0.1). Note that keeping internal_api_server_enabled at false only turns off the internal API server; in 0.5.5 the standalone lmcache server serves /run_script regardless of that setting, so set --http-host separately. PlainCVE note: binding to 127.0.0.1 alone is not enough. The PR #5129 author points out that lmcache_frontend on the same host binds 0.0.0.0 by default with no authentication, so the admin API may still be reachable remotely through it; also check the frontend's bind address or keep it off the network.

    Step 1
  3. 03Understand the status of PR #5129

    PR #5129 was merged into the dev branch by an LMCache collaborator on 2026-09-23 (commit 449b94c), and the source of pre-releases 0.5.6rc2 and 0.5.6rc3 includes it: /run_script returns 404 by default and the admin servers bind 127.0.0.1 by default. The latest stable release on PyPI is still 0.5.5, and LMCache has not published a security advisory. The change turns the endpoint off by default; it does not add authentication. Per the 0.5.6rc2 and 0.5.6rc3 source, /run_script always returns 404 unless run_script_api_enabled is on, so binding to a non-loopback address alone does not make it run code; but if run_script_api_enabled is on and the admin port is reachable from other machines, the endpoint still does not check who is calling and allows remote code execution.

    Step 2
RESPONDRespondIf you find signs of compromise
  1. 01Treat the host as possibly compromised

    If the admin port was exposed and logs show unknown /run_script requests, an attacker may have run commands with the server's privileges. PlainCVE suggests isolating the host and investigating.

    Step 5
  2. 02Rotate credentials in the process environment

    A reporter says environment variables such as cloud credentials and HF tokens can be read. If you confirm suspicious access, PlainCVE suggests rotating those credentials. This is a precaution, not confirmation of a leak.

    Step 5
HARDENHardenPrevent the next one
  1. 01Never expose admin ports to the network

    According to #5128, the project's own docs warn that this endpoint should be treated as full remote code execution.

    Step 1Step 2
  2. 02Don't run inference services as root

    Code runs with the server's privileges; lower privileges limit what an attacker can do.

    Step 5
Full remediation steps and notes

There is no stable fixed release (the latest stable release on PyPI is 0.5.5), and we found no LMCache security advisory in the sources reviewed. Work in this order:

  1. Confirm exposure first: pip show lmcache for the version; ss -tlnp to see whether the admin port is bound to 0.0.0.0 or 127.0.0.1. The standalone lmcache server defaults to port 8080; the internal API server, once enabled, uses ports starting at 6999. If you changed the ports, go by your own settings.
  2. Then reduce exposure: set internal_api_server_host and --http-host to 127.0.0.1 and block outside connections at the host or cloud firewall. Keeping internal_api_server_enabled at false alone does not protect a standalone lmcache server. PlainCVE note: binding to 127.0.0.1 alone is not enough. The PR #5129 author points out that lmcache_frontend on the same host binds 0.0.0.0 by default with no authentication, so the admin API may still be reachable through it; also check the frontend’s bind address and firewall.
  3. Understand the hardening change: PR #5129 adds run_script_api_enabled (environment variable LMCACHE_RUN_SCRIPT_API_ENABLED), default false, and changes both admin servers’ default bind address to 127.0.0.1. It was merged into the dev branch on 2026-09-23 (commit 449b94c), and the source of pre-releases 0.5.6rc2 (2026-09-28) and 0.5.6rc3 (2026-10-06) includes it. This is off-by-default, not authentication: per the 0.5.6rc2 and 0.5.6rc3 source, /run_script always returns 404 unless run_script_api_enabled is on, so binding to a non-loopback address alone does not make it run code; but if you enable run_script_api_enabled and the admin port is reachable from other machines, /run_script still does not check who is calling and allows remote code execution. Whether to install a pre-release is your call; until a stable release ships, steps 1 and 2 still apply.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

LMCache /run_script unauthenticated remote code execution: anyone who can reach the admin port can run Python: 1. Finds a reachable LMCache admin port → 2. Sends a script to /run_script with no login → 3. LMCache executes the uploaded script → 4. The import guard is bypassed → 5. Runs system commands as the LMCache processCVE-2026-107204 · LMCache /run_script unauthenticated remote code execution: anyone who can reach the adminport can run PythonAttackerYour systemFinds a reachable LMCache admin port — Per the v0.5.5 source, the standalone lmcache server HTTP frontend binds 0.0.0.0 (all network interfaces) on port 8080 by default; the internal API server embedded in vLLM is off by default and, once enabled, binds 0.0.0.0 with ports starting at 6999. In both cases the attacker needs network access to the admin port. 1Finds a reachableLMCache admin portSends a script to /run_script with no login — The endpoint does not check who is calling, and no user interaction is needed. 2Sends a script to/run_script withno loginLMCache executes the uploaded script — The 0.5.5 source runs the script with exec() and puts the live FastAPI app object into the variables the script can use. 3LMCache executesthe uploaded scriptThe import guard is bypassed — The restricted __import__ guard can be bypassed, letting an attacker import the os module (per the CVE record). 4The import guardis bypassedRuns system commands as the LMCache process — Commands run with the server's privileges, which a reporter says is typically root on GPU inference hosts; environment variables such as cloud credentials and HF tokens may be exposed. 5Runs systemcommands as theLMCache processAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-107204-lmcache-run-script-rce · CC BY 4.0
LMCache /run_script unauthenticated remote code execution: anyone who can reach the admin port can run Python: 1. Finds a reachable LMCache admin port → 2. Sends a script to /run_script with no login → 3. LMCache executes the uploaded script → 4. The import guard is bypassed → 5. Runs system commands as the LMCache processCVE-2026-107204 · LMCache /run_scriptunauthenticated remote code execution:anyone who can reach the admin port canrun PythonFinds a reachable LMCache admin port — Per the v0.5.5 source, the standalone lmcache server HTTP frontend binds 0.0.0.0 (all network interfaces) on port 8080 by default; the internal API server embedded in vLLM is off by default and, once enabled, binds 0.0.0.0 with ports starting at 6999. In both cases the attacker needs network access to the admin port. 1AttackerFinds a reachable LMCache adminportSends a script to /run_script with no login — The endpoint does not check who is calling, and no user interaction is needed. 2AttackerSends a script to /run_scriptwith no loginLMCache executes the uploaded script — The 0.5.5 source runs the script with exec() and puts the live FastAPI app object into the variables the script can use. 3Your systemLMCache executes the uploadedscriptThe import guard is bypassed — The restricted __import__ guard can be bypassed, letting an attacker import the os module (per the CVE record). 4Your systemThe import guard is bypassedRuns system commands as the LMCache process — Commands run with the server's privileges, which a reporter says is typically root on GPU inference hosts; environment variables such as cloud credentials and HF tokens may be exposed. 5AttackerRuns system commands as theLMCache processAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-107204-lmcache-run-script-rce
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    Finds a reachable LMCache admin port

    Per the v0.5.5 source, the standalone lmcache server HTTP frontend binds 0.0.0.0 (all network interfaces) on port 8080 by default; the internal API server embedded in vLLM is off by default and, once enabled, binds 0.0.0.0 with ports starting at 6999. In both cases the attacker needs network access to the admin port.

    Defense: Block outside access with firewall rules or ACLs and bind the admin servers to 127.0.0.1; per the PR #5129 author's warning, also check lmcache_frontend on the same host (binds 0.0.0.0 by default, no authentication).

  2. Attacker

    Sends a script to /run_script with no login

    The endpoint does not check who is calling, and no user interaction is needed.

    Defense: PR #5129 (merged; included in pre-releases 0.5.6rc2 and 0.5.6rc3) adds a run_script_api_enabled setting; when off (the default) /run_script returns 404. This is not authentication: if enabled manually, the endpoint still does not check who is calling.

  3. Your system

    LMCache executes the uploaded script

    The 0.5.5 source runs the script with exec() and puts the live FastAPI app object into the variables the script can use.

    Defense: Don't enable this feature unless you need it; by design it is remote code execution.

  4. Your system

    The import guard is bypassed

    The restricted __import__ guard can be bypassed, letting an attacker import the os module (per the CVE record).

    Defense: Restricted builtins are not a sandbox and cannot be relied on as protection.

  5. Attacker

    Runs system commands as the LMCache process

    Commands run with the server's privileges, which a reporter says is typically root on GPU inference hosts; environment variables such as cloud credentials and HF tokens may be exposed.

    Defense: Don't run the service as root, and keep only necessary credentials in its environment.

Who is affected

ConditionAffected?
lmcache 0.5.5 or earlier, internal API server enabled (internal_api_server_enabled), admin port reachable from other machinesAffected
lmcache 0.5.5 or earlier, running the standalone lmcache server HTTP frontend, admin port reachableIn the CVE record’s affected version range; per the v0.5.5 source, the default settings bind 0.0.0.0:8080 and mount the /run_script route. But the #5510 (that page contains exploit code; PlainCVE does not link to it) PoC environment additionally installed python-multipart, which is not in lmcache 0.5.5’s requires_dist, so whether a default install is always exploitable has not been confirmed
Admin port bound only to 127.0.0.1 and unreachable from outsideA remote attacker needs network access to the admin port; but the PR #5129 author points out that lmcache_frontend on the same host binds 0.0.0.0 by default with no authentication, so the admin API may be reachable through it; check the frontend too (PlainCVE note). Still upgrade once a stable fixed release ships
Pre-releases 0.5.6rc2 and 0.5.6rc3The source turns /run_script off by default (returns 404) and binds the admin servers to 127.0.0.1 by default; but no authentication is added, so turning on run_script_api_enabled while the admin port is reachable from other machines still allows remote code execution. The CVE record lists affected versions only through 0.5.5, and there is no official statement on whether this counts as a fix
Stable fixed releaseNone yet (the latest stable release on PyPI is 0.5.5)

Are default setups exposed? It depends on how you start LMCache. The two reports describe different launch modes. Per the v0.5.5 source:

  • Standalone lmcache server: the HTTP frontend’s http_host defaults to 0.0.0.0 and http_port to 8080 (multiprocess/config.py), and it automatically mounts every internal API router (_MP_INCOMPATIBLE_MODULES is empty), so /run_script is always present. A default standalone deployment serves this endpoint on all network interfaces (consistent with issue #5128). However, the #5510 (that page contains exploit code; PlainCVE does not link to it) PoC environment additionally installed python-multipart, which is not in lmcache 0.5.5’s requires_dist on PyPI; whether a default install is always exploitable has not been confirmed.
  • Internal API server embedded in vLLM: internal_api_server_enabled defaults to False and must be turned on; once enabled, internal_api_server_host defaults to 0.0.0.0 with ports starting at 6999 (config.py; consistent with issue #5510; that page contains exploit code, so PlainCVE does not link to it).

How it works

LMCache has an admin HTTP endpoint (a callable URL path), /run_script, whose job is to receive a Python script and run it. There are two layers to the problem:

  1. No authentication. The CVE record classifies it as CWE-306 (missing authentication for critical function): the endpoint doesn’t check who is calling. Reading the v0.5.5 source, PlainCVE also found no authentication check in the handler (this is our analysis, not a source’s words).
  2. The restriction doesn’t hold. The code runs the script with exec() and limits the builtins (functions Python provides by default, such as __import__ for loading modules). But it also puts the live FastAPI app object into the script’s variables. The CVE record says the guarded __import__ can be bypassed to import os and run operating system commands as the LMCache process. According to #5128, the project’s own docs already warn that the restricted builtins are not a sandbox and the endpoint should be treated as full remote code execution.

A reporter says the code runs with the server’s privileges, typically root on GPU inference hosts, and that process environment variables (such as cloud credentials and HF tokens) may be exposed.

The flawed approach (conceptual illustration, not the original source code):

Show code example(python)
# Anyone can call this, and the service listens on all interfaces
@app.post("/run_script")
def run_script(request, script):
    exec(script, {"__builtins__": limited, "app": request.app})

The approach in PR #5129 (merged; included in 0.5.6rc2 and 0.5.6rc3; off-by-default, not authentication):

Show code example(python)
# Off by default; admin servers listen only on localhost by default
if not settings.run_script_api_enabled:   # default False
    return 404
# host defaults to 127.0.0.1

Timeline

DateEvent
2026-09-15First disclosure: issue #5128 publicly reports the same problem on LMCache’s issue tracker (/run_script is unauthenticated, runs uploaded scripts with exec(), and the injected FastAPI app object defeats the restricted builtins); PR #5129 is opened the same day stating “Fixes #5128”. The CVE record does not cite #5128
2026-09-23PR #5129 (turns /run_script off by default, binds admin servers to 127.0.0.1 by default) is merged into the dev branch
2026-09-28Pre-release v0.5.6rc2 is published; its source includes the off-by-default change
2026-10-06Researcher opens issue #5510 (that page contains exploit code; PlainCVE does not link to it), confirmed against lmcache 0.5.5; public date (datePublic) listed by the CNA; pre-release v0.5.6rc3 is published
2026-10-07VulnCheck publishes the CVE record; NVD has received it but not analysed it; not listed in CISA KEV

Further reading

  • Scoring differences: the CNA (VulnCheck) gives 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0, both Critical; they are different versions of the scoring system. NVD has not published its own score.
  • CWE classification: the CNA uses CWE-306 (missing authentication); the researcher’s issue #5510 (that page contains exploit code; PlainCVE does not link to it) suggests CWE-94 (code injection). These are different ways of classifying the same bug, not a factual conflict.
  • Proof of concept (PoC): a public PoC exists. The reporting issue #5510 (that page contains exploit code; PlainCVE does not link to it) includes one; in the CVE record, CISA ADP tags that issue as exploit, and its SSVC rates exploitation as “poc”, automatable, with total technical impact. (An automated news site lists “No Public PoC Indexed”, meaning it found no standalone exploit in the research repositories it monitors; this does not change the above.)
  • Exploitation: not in KEV, and no source reports exploitation in the wild or use as a zero-day.
  • Don’t mix them up: The Hacker News coverage is mainly about a different LMCache flaw, CVE-2026-105192 (ZeroMQ/pickle); its claims should not be applied to this CVE.
  • Credited finders: Mingkai Yu and Jiajia Liu (per VulnCheck’s advisory).

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-12 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. CVE / NVD / OSVCVE-2026-107204 record (CVE Services API) · CVE Program / VulnCheck (CNA), 2026-10-07 · accessed 2026-10-07
  2. CVE / NVD / OSVNVD API - CVE-2026-107204 · NIST · accessed 2026-10-07
  3. AdvisoryLMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint · VulnCheck · accessed 2026-10-07
  4. ResearchLMCache issue #5128 · Reporter apejcic (third-party report, LMCache GitHub issue), 2026-09-15 · accessed 2026-10-07
  5. Patch / releaseLMCache PR #5129: disable /run_script by default and bind admin HTTP to 127.0.0.1 (merged 2026-09-23, commit 449b94c) · LMCache (GitHub), 2026-09-23 · accessed 2026-10-08
  6. Patch / releaserun_script_api.py at v0.5.6rc3 (pre-release) · LMCache (GitHub) · accessed 2026-10-08
  7. Patch / releaserun_script_api.py at v0.5.6rc2 (pre-release) · LMCache (GitHub) · accessed 2026-10-08
  8. VendorLMCache releases · LMCache (GitHub) · accessed 2026-10-08
  9. Vendormultiprocess/config.py at v0.5.5 (standalone server http_host / http_port defaults) · LMCache (GitHub) · accessed 2026-10-08
  10. Vendorconfig.py at v0.5.5 (internal API server defaults) · LMCache (GitHub) · accessed 2026-10-08
  11. Vendormultiprocess/http_apis/common_api.py at v0.5.5 · LMCache (GitHub) · accessed 2026-10-08
  12. Vendorlmcache on PyPI (JSON API) · PyPI · accessed 2026-10-08
  13. Vendorrun_script_api.py at v0.5.5 · LMCache (GitHub) · accessed 2026-10-07
  14. OtherCVE-2026-107204 LMCache through 0.5.5 unauthenticated RCE · HOL Guard · accessed 2026-10-07
  15. NewsCVE-2026-107204: Critical LMCache RCE exposes systems to unauthenticated Python code execution · TheHackerWire · accessed 2026-10-07
  16. NewsUnpatched critical LMCache flaw (CVE-2026-105192) · The Hacker News · accessed 2026-10-07

Press brief

In one sentence

LMCache is a Python package whose versions up to 0.5.5 include an admin endpoint, /run_script, that runs any Python script sent to it without checking who sent it. VulnCheck, which published the CVE, scores it 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0, both Critical. As of October 7, 2026 there is no stable fixed release (pre-releases 0.5.6rc2 and 0.5.6rc3 turn the endpoint off by default but add no authentication), and it is not on CISA's Known Exploited Vulnerabilities list.

Key facts

Severity
CVSS 3.1 9.8 / CVSS 4.0 9.3 (CNA: VulnCheck) cveawg.mitre.org
Affected versions
lmcache up to and including 0.5.5 cveawg.mitre.org
Fixed version
No stable release yet (latest stable is 0.5.5); pre-releases 0.5.6rc2 and 0.5.6rc3 disable /run_script by default, no authentication added github.com
First disclosed
2026-09-15 (LMCache issue #5128 publicly reports the same problem) github.com
CVE published
2026-10-07 cveawg.mitre.org
Credited finders
Mingkai Yu, Jiajia Liu vulncheck.com

Confirmed

  • The /run_script endpoint in lmcache up to 0.5.5 runs submitted Python code without authentication.
  • The import guard can be bypassed, letting an attacker run operating system commands as the LMCache process.
  • As of 2026-10-07 there is no stable fixed release (the latest stable release on PyPI is 0.5.5) and it is not listed in CISA KEV.
  • In the source of pre-releases 0.5.6rc2 and 0.5.6rc3, /run_script returns 404 unless run_script_api_enabled is turned on; this is off-by-default, not authentication.
  • A public proof of concept (PoC) exists: the reporting issue #5510 (that page contains exploit code; PlainCVE does not link to it) includes a PoC confirmed on 0.5.5; in the CVE record, CISA ADP tags that issue as exploit and its SSVC rates Exploitation: poc.

Unconfirmed / disputed

  • Whether the off-by-default change in pre-releases 0.5.6rc2 and 0.5.6rc3 counts as a fix for this CVE: the CVE record lists affected versions only through 0.5.5, and LMCache has published no security advisory on it.
  • No source reports exploitation in the wild (not listed in CISA KEV).
  • Whether default deployments are always exploitable: the PoC environment in the reporting issue #5510 (that page contains exploit code; PlainCVE does not link to it) is lmcache 0.5.5 plus a separately installed python-multipart, and lmcache 0.5.5's requires_dist on PyPI does not include python-multipart; whether /run_script is always exploitable with only a default install has not been confirmed.

Quotable line

This endpoint was built to run code it receives; the real problem is that it never asks who is sending it.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "LMCache /run_script unauthenticated remote code execution: anyone who can reach the admin port can run Python". PlainCVE. https://plaincve.date/en/vulns/cve-2026-107204-lmcache-run-script-rce (accessed YYYY-MM-DD)
BibTeX
@misc{cve2026107204lmcacherunscriptrce2026,
  title  = {LMCache /run_script unauthenticated remote code execution: anyone who can reach the admin port can run Python},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-107204-lmcache-run-script-rce},
  note   = {Updated 2026-10-12}
}