Summary
LMCache through version 0.5.5 exposes the /run_script endpoint without sufficient authentication, allowing remote attackers to submit Python code for execution.
Because the endpoint can be reached without valid credentials, an attacker may execute operating-system commands with the privileges of the LMCache process.
LMCache through version 0.5.5 exposes the /run_script endpoint without sufficient authentication, allowing remote attackers to submit Python code for execution.
Because the endpoint can be reached without valid credentials, an attacker may execute operating-system commands with the privileges of the LMCache process.
Affected context
The vulnerability occurs in LMCache deployments that expose the FastAPI-based /run_script endpoint to an attacker and do not place effective authentication or network restrictions in front of it. Risk is higher when the service is reachable from untrusted networks or runs with access to sensitive files, credentials, model data, or other internal services.
The vulnerability occurs in LMCache deployments that expose the FastAPI-based /run_script endpoint to an attacker and do not place effective authentication or network restrictions in front of it. Risk is higher when the service is reachable from untrusted networks or runs with access to sensitive files, credentials, model data, or other internal services.
Exploit preconditions
- Attack surface: Network-accessible LMCache
/run_scriptendpoint - Required access: No valid authentication is required when the endpoint is exposed
- Trigger point: Submission of a script to the endpoint
- Why exploitation is possible: The endpoint accepts attacker-controlled Python code and provides an application context from which restricted functionality can be recovered, enabling operating-system command execution
- Attack surface: Network-accessible LMCache
/run_scriptendpoint - Required access: No valid authentication is required when the endpoint is exposed
- Trigger point: Submission of a script to the endpoint
- Why exploitation is possible: The endpoint accepts attacker-controlled Python code and provides an application context from which restricted functionality can be recovered, enabling operating-system command execution
Why this happens
The underlying issue is a missing authentication control on a security-sensitive code-execution endpoint. The service treats requests to /run_script as authorized without reliably verifying the caller's identity or permissions, mapping to CWE-306: Missing Authentication for Critical Function. Exposing an interpreter-backed operation through an unauthenticated HTTP route creates a direct path from remote input to process-level code execution.
The underlying issue is a missing authentication control on a security-sensitive code-execution endpoint. The service treats requests to /run_script as authorized without reliably verifying the caller's identity or permissions, mapping to CWE-306: Missing Authentication for Critical Function. Exposing an interpreter-backed operation through an unauthenticated HTTP route creates a direct path from remote input to process-level code execution.
Potential impact
- An unauthenticated attacker may execute arbitrary Python code in the LMCache process
- The attacker could run operating-system commands with the service account's privileges
- Sensitive files, environment variables, credentials, or cached data may be exposed
- The host or container could be used for lateral movement or further compromise
- Model-serving availability and integrity could be disrupted
- An unauthenticated attacker may execute arbitrary Python code in the LMCache process
- The attacker could run operating-system commands with the service account's privileges
- Sensitive files, environment variables, credentials, or cached data may be exposed
- The host or container could be used for lateral movement or further compromise
- Model-serving availability and integrity could be disrupted
General mitigation guidance
Mitigation generally centers on removing unauthenticated access to interpreter-backed functionality and reducing the service's trust and privilege boundaries.
Common defensive patterns include:
- Disabling or removing script-execution endpoints when they are not essential
- Enforcing strong authentication and authorization before any administrative or execution function
- Restricting management interfaces to trusted networks through segmentation and policy enforcement
- Running the service with a dedicated least-privileged identity and minimal filesystem and network permissions
- Avoiding exposure of application objects or interpreter capabilities to request handlers
- Applying secure-by-default deployment configurations that bind administrative interfaces privately
- Separating code-execution or maintenance workflows from publicly reachable application paths
Mitigation generally centers on removing unauthenticated access to interpreter-backed functionality and reducing the service's trust and privilege boundaries.
Common defensive patterns include:
- Disabling or removing script-execution endpoints when they are not essential
- Enforcing strong authentication and authorization before any administrative or execution function
- Restricting management interfaces to trusted networks through segmentation and policy enforcement
- Running the service with a dedicated least-privileged identity and minimal filesystem and network permissions
- Avoiding exposure of application objects or interpreter capabilities to request handlers
- Applying secure-by-default deployment configurations that bind administrative interfaces privately
- Separating code-execution or maintenance workflows from publicly reachable application paths
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis and code review rules identifying unauthenticated routes that invoke interpreters, subprocesses, dynamic evaluation, or script runners
- Review of FastAPI route dependencies to confirm authentication and authorization are consistently enforced
- Configuration and infrastructure scans for publicly reachable LMCache management endpoints
- Web and application logs showing requests to
/run_script, especially from unexpected sources or without an authenticated identity - Network policy checks confirming that administrative endpoints are limited to approved clients
- Automated security review tools that flag exposed code-execution functionality and missing route guards
Organizations can look for this weakness through:
- Static analysis and code review rules identifying unauthenticated routes that invoke interpreters, subprocesses, dynamic evaluation, or script runners
- Review of FastAPI route dependencies to confirm authentication and authorization are consistently enforced
- Configuration and infrastructure scans for publicly reachable LMCache management endpoints
- Web and application logs showing requests to
/run_script, especially from unexpected sources or without an authenticated identity - Network policy checks confirming that administrative endpoints are limited to approved clients
- Automated security review tools that flag exposed code-execution functionality and missing route guards
