Unpatched LMCache Flaw Hands Remote Code Execution to Anyone on the Network

On October 7, JFrog disclosed a critical vulnerability in LMCache, the open-source software that speeds up large language model servers such as vLLM. The flaw carries a severity score of 9.8 out of 10 and the identifier CVE-2026-105192. At the time of disclosure, no fixed version exists.

Where the hole hides

The problem lies in LMCache's multiprocess mode, where the cache runs as a standalone server and the model's worker processes reach it over the ZeroMQ messaging library. The socket the server opens for processes to register and share cached data requires no authentication at all. One type of message is unpacked with pickle — a Python format that can carry and execute code the moment it is decoded. The server unpacks the message before it even checks the message's type, so a crafted message runs the sender's code.

The code runs with the privileges of the LMCache process. On the project's official container images, JFrog says, that process runs as root. The flaw was found by Yuval Moravchick of JFrog's security research team.

Not dangerous everywhere

It all comes down to a single setting. By default the multiprocess server listens only on the local machine, so nothing outside can reach it. It becomes reachable only when an operator starts it on a routable address — as happens in multi-node setups that share a cache across machines. LMCache's own Kubernetes example deployment does exactly that, listening on every network interface. An LMCache instance running inside a single vLLM process does not open the port at all.

Affected versions run from 0.3.9 (October 2025) through the current stable 0.5.5, as well as the 0.5.6 release candidates and the development branch.

What to do

There is no patch. Until one ships, JFrog advises operators not to give the multiprocess server a routable address and to keep the port on the local machine or a trusted cluster network. A firewall lowers the risk but does not remove it: any host that can still open a connection can run code. LMCache has not published a security advisory, and JFrog's guidance offers no way to tell whether a server has already been attacked.

Separately, on October 6 a single GitHub user filed six more LMCache reports, including claims of unauthorized access to other tenants' data. All come from one account, rest on proof-of-concept claims, and remain unconfirmed by the maintainers. A related vLLM flaw (CVE-2026-105756, rated 6.5) has already been fixed: before version 0.30.0, a request with a malformed cache_salt value could crash the engine.

The root mistake — handing data from an unauthenticated socket to pickle — is the same one researchers found across other AI inference frameworks back in November 2025, in a cluster of flaws dubbed ShadowMQ.

Source: The Hacker News