CVE-2026-91996

lamp-cloud through 5.10.0 whitelists the URL pattern /*/anno/** for anonymous access, which leaves the endpoint POST /defGenProject/anno/getProperties reachable without any credentials (CWE-306, missing authentication for a critical function). An unauthenticated remote attacker simply sends a POST request to that path and receives the server's full JVM system property map. The leaked data includes the JVM classpath, filesystem paths, operating system details, and startup secrets — reconnaissance material that can enable targeted follow-on attacks against the host or other services. Any internet-reachable deployment of the lamp-cloud microservices platform through version 5.10.0 that retains the default anonymous whitelist is affected. No public proof of concept or in-the-wild exploitation is known and the flaw is not in CISA's KEV catalog, but the trivial single-request nature of the attack makes exploitation likely once exposed deployments are identified.

What to do: Restrict or remove the /*/anno/** anonymous-access whitelist entry so that /defGenProject/anno/getProperties requires authentication, and as an interim measure block unauthenticated POST requests to that path at the API gateway or WAF. Rotate any secrets that were passed as JVM startup properties (-D arguments), since they may already have been read. Review access logs for unauthenticated POSTs to /anno/getProperties and upgrade to a release newer than 5.10.0 once a fix is published.