The vulnerability arises from a missing authentication requirement in LMCache's multiprocess HTTP server. Because the server exposes management endpoints on all interfaces by default, any remote host can send HTTP requests to endpoints such as /env, /config, /clear-cache, /delete-object, and /modify-quotas. The attacker can read sensitive credentials, change configuration, clear cache entries, delete objects, and adjust tenant quotas, thereby evicting other tenants' cached data. This permits full unauthorized control of the caching engine and the sensitive information it holds.

The weakness affects the LMCache product, version 0.5.5, when running in multiprocess mode. Clients that perform management operations against the HTTP API are exposed on all network interfaces unless the administrator explicitly changes the binding configuration. The vulnerability is present in all releases of LMCache up to and including 0.5.5. Upgrading beyond that release removes the missing authentication flaw.

The CVSS score of 8.8 indicates high severity, while no EPSS data is available and the issue is not in KEV. The lack of authentication makes the flaw trivial to exploit over the network. An attacker only needs the server's IP address and the listening port; HTTP GET requests to the protected paths suffice. Because the API is designed for internal use, the attack vector is commonly considered remote network exploitation, but the poor default binding and lack of authentication create a significant risk for organizations exposing the endpoints externally.