Critical LMCache Flaw Enables Unauthenticated Remote Code Execution
Summary
CVE-2026-105192 lets unauthenticated attackers run code on exposed LMCache multiprocess servers. Versions 0.3.9 through 0.5.5 and some prereleases are affected; no fix is available, and operators should avoid routable addresses.
Key points
- A crafted network message can execute attacker-controlled code through unauthenticated ZeroMQ communication and unsafe pickle deserialization.
- The flaw affects LMCache versions 0.3.9 through 0.5.5, as well as 0.5.6 release candidates and the development branch; no patched version is available.
- Remote reachability requires the multiprocess server to listen on a routable address. By default, it listens only on the local machine.
- LMCache's example Kubernetes deployment listens on every network interface; the standalone cache process runs code with its own privileges, and official container images run it as root, according to JFrog.
- JFrog advises keeping the server bound to the local machine or a trusted cluster network until a fix is released. Firewalls reduce exposure but do not protect against hosts that can still connect.
- JFrog disclosed the vulnerability on October 7 and rated it 9.8 out of 10. Its advisory provides no method for determining whether a server was previously attacked.
- A separate vLLM denial-of-service flaw, CVE-2026-105756, was fixed in version 0.30.0 and does not enable code execution.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution via unsafe pickle deserialization in LMCache multiprocess mode
- Denial of service in vLLM triggered by a malformed cache_salt value when using the LMCache multiprocess connector
- Severity
- Critical (9.8/10) for CVE-2026-105192; the related vLLM denial-of-service flaw is rated 6.5
- Affected Versions
- LMCache 0.3.9 through 0.5.5; also present in 0.5.6 release candidates and the development branch
- vLLM versions before 0.30.0 for CVE-2026-105756
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Do not assign the LMCache multiprocess server a routable address; keep its port on the local machine or a trusted cluster network.
- Use a firewall to limit access to the port; this lowers risk but does not eliminate it.
CVE
CVE-2026-105192The vulnerability, tracked as CVE-2026-105192, affects LMCache from version 0.3.9, released in October 2025, through 0.5.5, the latest stable release, and is also present in the 0.5.6 release candidates and theCVE-2026-105756on deployments that use the LMCache multiprocess connector, a denial-of-service bug tracked as CVE-2026-105756. It is rated 6.5 and does not allow code execution.
People
Products
LMCacheA critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version isvLLMvulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available.