Description
LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach internal hosts, read responses, and tamper with nodes or stop the heartbeat.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
LMCache LMCache
Default version status: unaffected
0 to ≤ 0.5.5affected
pkg:pypi/lmcacheReferences
- https://github.com/LMCache/LMCache/issues/5512 ↗
- https://github.com/LMCache/LMCache ↗
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/lmcache_frontend/app.py#L411-L428 ↗
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/lmcache_frontend/app.py#L567-L604 ↗
- https://www.vulncheck.com/advisories/lmcache-through-0.5.5-missing-authentication-in-frontend-node-catalog-allows-ssrf-allowlist-bypass ↗