CVE-2026-91996 — lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Atta…
Published: 2026-09-15 · CVSS: 8.7 · CVSS 4.0
lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7