CVE-2026-91996: lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
lamp-cloud through 5.10.0 whitelists the path pattern //anno/ for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
lamp-cloud deployments through version 5.10.0 are exposed if the affected endpoint is reachable. The anonymous-access whitelist pattern /*/anno/** includes the vulnerable path.
What does an attacker need to exploit this issue?
An attacker needs only network access to the application endpoint and can send an unauthenticated POST request to /defGenProject/anno/getProperties. No credentials or user interaction are required.
What information can be obtained?
The endpoint returns the server's full JVM system property map. This can include the JVM classpath, filesystem paths, operating-system details, and startup secrets.
How can I check whether an instance is affected?
Determine whether the deployment runs lamp-cloud 5.10.0 or earlier and whether /defGenProject/anno/getProperties is reachable. A POST request to that path returning JVM system properties indicates exposure.