ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-105192

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

Published Oct 16, 2026 · catalog updated Oct 16, 2026 · LMCache: Remote code execution

Check if you run it

No confirmed exploitation is on record for CVE-2026-105192. EPSS is 0.48%. Act only if a listed version of LMCache: Remote code execution is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (LMCache: Remote code execution).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical9.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.48%
Remediation
Version ranges on file
Affected products
PyPI lmcache · pip lmcache · pypi lmcache

### Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport ### Details LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. The intended clients are sibling LMCache processes. There is no CURVE, ZAP, password, or message authentication on that socket. LMCache used only inside a vLLM process does not open this port. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect. The 9.8 score is for that routable configuration. A stock single-host install that leaves the default bind is not reachable from other machines. Messages on the socket are msgpack. Extension code 1 is registered for DeviceIPCWrapper and is passed to DeviceIPCWrapper.Deserialize in lmcache/v1/platform/base/ipc_wrapper.py, which calls pickle.loads. That hook runs from ext_hook in lmcache/v1/multiprocess/custom_types.py while the server is still decoding REGISTER_KV_CACHE arguments, before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The decode path shipped in v0.3.9. It is still present in the latest PyPI release, v0.5.5, in the v0.5.6 release candidates through v0.5.6rc3, and on the dev branch as of 2026-10-07. No fixed version has been published. ### Proof of concept Step 1 - Start multiprocess mode bound to a routable address This is the documented multi-node setting. The ZMQ transport listens on port 5555. Step 2 - Build a REGISTER_KV_CACHE frame whose cache slot is a pickle Payload slot 1 is a msgpack extension with code 1. The server unpickles that body while it is still decoding arguments. The command writes id to /tmp/zmq_pwn. Step 3 - Send the frame The pickle r

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI lmcache0.3.9 → 0.5.6
  • pip lmcache>= 0.3.9, < 0.5.6
  • pypi lmcacheversion unspecified

How to fix CVE-2026-105192

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-105192. EPSS is 0.48%. Act only if a listed version of LMCache: Remote code execution is installed.

Which versions are affected?

Compare what you have installed with 0.3.9 → 0.5.6, >= 0.3.9, < 0.5.6. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-306: Missing Authentication for Critical Function. EPSS 0.48%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · GitHub Advisory Database

    Detected

    ### Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport ### Details LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. The intended clients are sibling LMCache processes. There is no CURVE, ZAP, password, or message

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    lmcache fixed in 0.5.6

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    lmcache fixed in 0.5.6

  4. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ### Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport ### Details LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. The intended clients are sibling LMCache processes. There is no CURVE, ZAP, password, or message

Sources

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.