LMCache libraries up to version 0.5.5 suffer from a missing authentication flaw in the multiprocess coordinator, allowing remote attackers to access the fleet control API without credentials. The exposed endpoints enable attackers to register or deregister instances, override resource quotas, inject arbitrary events, and enumerate placement metadata, potentially causing cache disruption and data exposure. This flaw aligns with CWE-306, a lack of authentication that permits unauthorized API interactions.

The vulnerability affects the LMCache product from LMCache. Any deployment of LMCache through 0.5.5, which by default listens on all network interfaces, is at risk. No other specific version numbers are listed, so all versions up to and including 0.5.5 are considered vulnerable.

The CVSS score of 8.8 classifies this defect as high severity, and the absence of authentication means the attack vector is remote network access to the HTTP API. While an EPSS score is not available and the issue is not present in the CISA KEV catalog, the combination of a high CVSS score and a lack of authentication suggests a high likelihood that attackers could exploit this flaw if the API is reachable from untrusted networks.