CVE-2026-105192: RCE in LMCache multiprocess mode

RCE in LMCache via unauthenticated ZeroMQ. Versions 0.3.9-0.5.5 vulnerable. Fix in v0.5.6 released Oct 14.

CVE-2026-105192 is a remote code execution vulnerability in LMCache, the cache layer of vLLM. In multiprocess mode, LMCache exposes an unauthenticated ZeroMQ ROUTER socket on port 5555 to allow worker processes to register and share cache blocks. During message deserialization, extension code 1 is passed to pickle.loads before any request validation occurs. An unauthenticated attacker can send a malformed ZeroMQ message and achieve arbitrary Python code execution with the privileges of the LMCache process—root in official container images.

CVSS score is 9.8 (critical). No authentication is required. The default binding is localhost, but when operators configure a routable address with --host for multi-node deployments, the attack becomes remote. The CVE was disclosed by JFrog on October 7, 2026. Proof of concept code was made public the same day. Patches released on October 14 with version v0.5.6. Community discussions persist on social media as of late October, indicating awareness is still spreading.

System administrators and IT teams must update LMCache to v0.5.6 or later immediately. All versions from v0.3.9 through v0.5.5 are vulnerable, including v0.5.6 release candidates. If immediate patching is not feasible, ensure the ZeroMQ socket binds to localhost only in isolated single-node environments, mitigating the attack surface to a local threat. Monitor access logs on port 5555 for suspicious connection attempts.

At a glance

What: In multiprocess mode (distributed mode), LMCache exposes an unauthenticated ZeroMQ ROUTER socket on port 5555 to allow worker processes to register and share KV cache blocks. During message deserialization via msgpack, extension code 1 is passed to DeviceIPCWrapper.Deserialize, which invokes pickle.loads before request validation occurs. A malformed ZeroMQ message from an unauthenticated attacker enables arbitrary Python code execution with the privileges of the LMCache process.
Severity: CVSS 9.8 (critical). No authentication required. Default binding is localhost; however, when operators configure a routable address with --host for multi-node deployments, the attack becomes remote. Maximum impact: official container images run LMCache as root, so a single message enables root-level code execution.
Affected versions: v0.3.9 through v0.5.5, including v0.5.6 release candidates. Vulnerable code was introduced in v0.3.9 and remains present through v0.5.5.
Fix: v0.5.6, released October 14, 2026, removes pickle.loads from the deserialization path. Immediate update recommended.
Status: Disclosed by JFrog on October 7, 2026. Proof of concept code made public the same day. Official patch available since October 14. Public discussions persist as of late October, indicating awareness is still spreading.
Action: Update LMCache to v0.5.6 or later as soon as possible. If immediate patching is not feasible, ensure the ZeroMQ socket binds to localhost only in isolated single-node environments. Monitor logs for suspicious access attempts on port 5555.

Sources: NVD, CVE-2026-105192

← All articles