CVE-2026-105192

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 0.48%
EPSS Percentile: 39.68%
CISA KEV: Not listed

Description

LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: reefs@jfrog.com
Published: 07-Oct-2026 17:17
Last Modified: 08-Oct-2026 01:17
EPSS Date: 2026-10-10
CWE: CWE-306, CWE-502

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 11-Oct-2026 12:36
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

CVE-2026-106358, CVE-2026-106347 (Google Chrome), CVE-2026-102255 (SonicWall SMA 1000), CVE-2026-105192 (LMCache), CVE-2026-102406, CVE-2026-103008, CVE-2026-102404, CVE-2026-102413 (Elasticsearch), Weekly Cybersecurity Recap Highlights Exploited Atlassian Flaw and Other Threats
The vulnerability, tracked as CVE-2026-105192, affects LMCache from version 0.3.9, released in October 2025, through 0.5.5, the latest stable release, and is also present in the 0.5.6 release candidates and the Critical LMCache Flaw Enables Unauthenticated Remote Code Execution

CVE (53)

People (1)

Vendors (1)

Products (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.