Unauthenticated Information Disclosure in lamp-cloud via CVE-2026-91996

CVE-2026-91996 is an authentication bypass vulnerability affecting lamp-cloud versions up to and including 5.10.0. The vulnerability originates from an overly permissive whitelist configuration that allows unauthenticated access to the path pattern /*/anno/**. Defenders should be aware that this configuration enables remote, unauthenticated actors to access sensitive internal endpoints without valid session credentials.

The most critical impact of this vulnerability is the potential for information disclosure via the /defGenProject/anno/getProperties endpoint. By sending a crafted POST request to this endpoint, an attacker can extract the server's full JVM system property map. This data contains sensitive environment information including the full JVM classpath, absolute filesystem paths, operating system metadata, and internal startup configuration secrets. This exposure provides significant reconnaissance value to an attacker, potentially facilitating further exploitation of the underlying host or the application infrastructure.

Impact

Successful exploitation allows remote, unauthenticated attackers to conduct reconnaissance and gain access to sensitive server-side configuration secrets. The disclosed JVM properties often include internal paths, service secrets, and deployment details that assist in lateral movement or subsequent privilege escalation attempts against the host environment.

Recommendation

• Upgrade lamp-cloud to a patched version beyond 5.10.0 immediately to remove the insecure authentication bypass.
• Monitor web server access logs for anomalous POST requests targeting the /anno/ URI pattern, specifically the /defGenProject/anno/getProperties endpoint.
• Audit custom authentication filters and path whitelists to ensure no sensitive internal management endpoints are reachable without authorization.