CVE-2026-91996— lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
Quick assessment
Affected
dromara lamp-cloud
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
lamp-cloud 5.10.0 及更早版本对路径模式 进行了白名单设置，允许匿名用户访问，从而使未经身份验证的攻击者能够读取服务器完整的 JVM 系统属性映射。攻击者可以向 发送 POST 请求，获取敏感信息，包括 JVM 类路径、文件系统路径、操作系统详细信息以及启动密钥等。
Possible ATT&CK Techniques 3 AI
T1082 · System Information Discovery T1190 · Exploit Public-Facing Application T1592.001 · Hardware
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91996
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| dromara | lamp-cloud | 0 ~ 5.10.0 | - |
|
II. Public POCs for CVE-2026-91996
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91996
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-91996 (1)
Other References for CVE-2026-91996 (4)
IV. Related Vulnerabilities
Same product: lamp-cloud
-
CVE-2026-19758
dromara lamp-cloud chunk-check endpoint FileChunkController. -
CVE-2026-19757
Dromara lamp-cloud File-Upload Controller FileAnyoneControll -
CVE-2026-19756
Dromara lamp-cloud Code Generator DefGenProjectController.ja -
CVE-2026-69100
LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code -
CVE-2026-9498
Dromara lamp-cloud Message Template GroovyClassLoader.parseC
Same vendor: dromara
-
CVE-2026-91993
Jpom through 2.11.12 Workspace Isolation Bypass via /build/b -
CVE-2026-90510
dromara orion-visor HostKeyServiceImpl.java HostKeyServiceIm -
CVE-2026-90509
dromara orion-visor ExposeApiAspect.java ExposeApiAspect.bef -
CVE-2026-78140
Dromara UJCMS web-file-template Endpoint WebFileTemplateCont -
CVE-2026-77795
Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController
Same weakness: CWE-306
-
CVE-2026-59971
MySQL MCP Server: Missing Origin/Host Validation in SSE Tran -
CVE-2026-57140
PraisonAI AgentOS exposes unauthenticated agent listing and -
CVE-2026-57139
PraisonAI MCPServer exposes unauthenticated HTTP tools/call -
CVE-2026-57112
PraisonAI ToolsMCPServer legacy SSE transport accepts attack -
CVE-2026-91002
stamparm maltrail Blacklist Endpoint httpd.py _blacklist mis
V. Comments for CVE-2026-91996
No comments yet