Key points
- CVE-2026-105192 affects LMCache versions 0.3.9 through 0.5.5 in multiprocess mode.
- The flaw enables unauthenticated remote code execution via a vulnerable ZeroMQ port.
- Official container images run the vulnerable process as root, increasing risk.
LMCache contains a critical security flaw that lets attackers run arbitrary code on servers without needing any login credentials. This issue exists in the multiprocess mode used for distributed deployments. It affects versions starting from 0.3.9 up to 0.5.5. The vulnerability is rated critical with a CVSS score of 9.8 when the service is exposed to a network.
How it unfolded
- Version 0.3.9 introduced a decode path that processes messages using Python's pickle library.
- The flaw remained in the latest PyPI release, version 0.5.5, and in release candidates up to 0.5.6rc3.
- As of October 7, 2026, the vulnerability was still present on the development branch, with no fixed version published.
Who is affected
System administrators running LMCache in multiprocess or distributed mode are at risk. This mode opens a ZeroMQ ROUTER socket for worker processes to share cache blocks. The socket lacks authentication mechanisms like passwords or message verification. If the service is bound to a routable address instead of localhost, it becomes reachable from other machines. Single-host installations that keep the default localhost binding are not reachable from external networks.
What happens next
Attackers can send a single unauthenticated message to the transport port, default 5555, to execute code. The code runs with the same privileges as the LMCache process. Official container images run this process as root, meaning an attacker could gain full control of the host system. The exploit leverages pickle deserialization during the registration of cache blocks. No patch has been confirmed yet, leaving systems vulnerable until a fix is released.
The background in plain language
Remote code execution flaws allow attackers to run commands on a server. Pickle deserialization is a common cause when applications process untrusted data without verification. Multiprocess mode enables distributed computing by sharing data between processes. Without authentication, any network user can send malicious data. Teams usually restrict access to such ports using firewalls. Check whether your services expose internal ports to untrusted networks. Ensure that processes run with limited privileges to reduce impact if a breach occurs.
Background: Remote code execution vulnerabilities
Monitor for unexpected child processes, sudden spikes in outbound network traffic, and anomalous file creation. Combine static analysis with runtime behavior monitoring to catch execution attempts before they establish persistence or exfiltrate data.
Read the full guide: Detect Remote Code Execution: Signals, Tools, and Blind Spots
What to do and how to stay safe: LMCache
- Review firewall rules to block external access to port 5555 and other internal service ports.
- Verify that LMCache instances are bound to localhost unless multi-node connectivity is strictly required.
- Monitor logs for unexpected process executions or connections to the ZeroMQ transport port.
- Plan to upgrade to version 0.5.6 or later once the vendor provides a confirmed secure update.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of LMCache are vulnerable to CVE-2026-105192?
Versions 0.3.9 through 0.5.5 are vulnerable. The flaw is also present in release candidates up to 0.5.6rc3 and on the dev branch as of October 7, 2026.
Does running LMCache in single-host mode expose this vulnerability?
No. Single-host installations that use the default localhost binding are not reachable from other machines and are not affected by this remote exploit.
Is there a patch available for this critical flaw?
No fixed version has been published yet. Users should wait for an official update from the vendor before applying a fix.
