CVE-2026-91996: lamp-cloud Information Disclosure Flaw

CVE-2026-91996 Overview

CVE-2026-91996 is a missing authentication vulnerability [CWE-306] in the lamp-cloud framework through version 5.10.0. The application whitelists the path pattern /*/anno/** for anonymous access, which unintentionally exposes an internal endpoint that returns the JVM system property map. Unauthenticated attackers can send POST requests to /defGenProject/anno/getProperties to retrieve JVM classpath entries, filesystem paths, operating system details, and startup secrets. The disclosed data supports follow-on reconnaissance and targeted exploitation of the host and its adjacent services.

Critical Impact
Remote, unauthenticated attackers can read the full JVM system property map, exposing classpaths, host paths, OS metadata, and secrets injected at process startup.

Affected Products

lamp-cloud versions up to and including 5.10.0
lamp-generator module exposing DefGenProjectController
Deployments relying on the default IgnoreProperties whitelist configuration

Discovery Timeline

2026-09-15 - CVE-2026-91996 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91996

Vulnerability Analysis

The lamp-cloud gateway applies an authentication skip rule for any URL matching /*/anno/**. The anno segment is intended for endpoints explicitly marked as anonymous by developers. However, the DefGenProjectController in the lamp-generator module exposes a getProperties handler under this pattern that returns the JVM system property map through System.getProperties(). Because the path matcher applies globally, the endpoint inherits anonymous access and can be reached without credentials.

An attacker who reaches the exposed HTTP surface receives detailed environment data. Response fields typically include java.class.path, user.dir, user.home, os.name, os.version, and any custom -D properties passed at startup. Operators frequently pass database URLs, cloud credentials, and encryption keys through such properties, so a single request can yield high-value secrets.

Root Cause

The root cause is an overly broad anonymous-access whitelist combined with an internal debug-style endpoint mapped under the same pattern. The IgnoreProperties configuration treats /*/anno/** as public, and the controller under lamp-generator-controller does not enforce its own authentication or authorization check. See the Lamp Generator Controller code and the IgnoreProperties whitelist entry.

Attack Vector

Exploitation requires only network reachability to the affected service. An attacker issues an unauthenticated POST request to /defGenProject/anno/getProperties and parses the JSON response containing the JVM system properties. No user interaction, privileges, or prior foothold are required. Additional technical detail is documented in the VulnCheck advisory and the public write-up.

Detection Methods for CVE-2026-91996

Indicators of Compromise

Unauthenticated POST requests to URI paths ending in /anno/getProperties, including /defGenProject/anno/getProperties.
HTTP responses from lamp-cloud services containing JSON keys such as java.class.path, user.dir, or os.name.
Requests to the /anno/** path space originating from external or non-corporate IP ranges.

Detection Strategies

Inspect web and reverse-proxy access logs for the substring /anno/getProperties and correlate with response sizes larger than typical anonymous endpoints.
Add a WAF or API gateway rule that alerts when unauthenticated clients receive responses containing JVM property key names.
Review outbound egress from lamp-cloud hosts for lateral movement following anonymous access to the generator module.

Monitoring Recommendations

Baseline traffic to any URL under the /anno/** pattern and alert on volume spikes or new source IPs.
Forward lamp-cloud application and gateway logs to a centralized analytics platform for retention and correlation.
Track process restarts of lamp-cloud services after suspected exposure, since attackers may pivot on disclosed credentials.

How to Mitigate CVE-2026-91996

Immediate Actions Required

Block external access to /*/anno/getProperties and related debug endpoints at the reverse proxy, WAF, or API gateway.
Rotate any secrets, database credentials, API keys, or encryption keys that were passed to the JVM as -D system properties.
Audit IgnoreProperties configuration and remove or narrow the /*/anno/** whitelist entry.

Patch Information

No fixed release is referenced in the advisory at time of publication. Monitor the lamp-cloud repository for a release after 5.10.0 that removes anonymous access to DefGenProjectController.getProperties or enforces authentication on the endpoint. Until an official patch is available, treat the endpoint as unauthenticated by design and compensate with the workarounds below.

Workarounds

Remove the DefGenProjectControllergetProperties mapping in environments where the code generator is not required.
Restrict access to lamp-cloud management interfaces to trusted internal networks or authenticated administrative VPN users.
Add an explicit authentication filter that overrides the anonymous whitelist for any URI containing getProperties.
Avoid passing secrets as JVM system properties; use a secrets manager or environment variables scoped to the runtime user.

bash

# Example nginx block to deny unauthenticated access to the vulnerable endpoint
location ~* /anno/getProperties$ {
    deny all;
    return 403;
}