lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint (CVE-2026-91996)

lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint (CVE-2026-91996) | HOL Guard CVE

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps dromara/lamp-cloud (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
dromara/lamp-cloudgeneric	0	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for dromara/lamp-cloud.
Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 15, 2026

Sources and claim methodology

Upstream source description

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.

Quoted source text, attributed separately from HOL analysis.