LMCache CVE-2026-105192: An Unauthenticated ZeroMQ Socket Lets Attackers Run Code on Your Inference Server

On October 7, 2026, JFrog published a critical vulnerability (CVSS 9.8) in LMCache, the key-value cache that speeds up inference servers such as vLLM: a single unauthenticated network message is enough to execute code, and no fixed version exists yet.

What LMCache Is and Why It Matters

LMCache is open-source software that stores and reuses the KV cache of language models so that inference engines like vLLM don’t recompute context they have already processed. It is used in self-hosted LLM deployments where several processes or nodes share that cache. It is "invisible" infrastructure: it is neither the model nor the application, but it runs with access to GPUs, models, and often customer data.

How the Flaw Works (CVE-2026-105192)

According to the advisory from JFrog Security Research (discovered by Yuval Moravchick), LMCache’s multiprocess mode opens a ZeroMQ ROUTER socket, on port 5555 by default, with no authentication mechanism at all. Messages travel in msgpack, and a format extension (code 1) calls pickle.loads on the received data. Because that deserialization happens while the server is still decoding the message, the attacker’s code runs before any validation logic gets a chance.

Pickle is a Python format that can rebuild arbitrary objects, including ones that run commands when loaded; deserializing pickle from an untrusted source is therefore equivalent to handing the sender a shell. According to JFrog, the official container images run the process as root, which makes the impact worse.

When You Are Actually Exposed

By default the multiprocess server listens only on the local machine, so another host cannot reach it. Exposure appears when someone starts it with a routable address, something The Hacker News says LMCache’s own Kubernetes deployment example does in order to share cache between nodes. In other words: the "multi-node" setup many teams copy from the documentation is precisely the vulnerable one.

What to Do Today

JFrog recommends not assigning the multiprocess server a routable address and keeping its port on localhost or on a trusted cluster network. Firewall rules reduce the risk but do not eliminate it. The underlying fix, JFrog says, is to replace pickle with a safe format and to authenticate the transport (CURVE or HMAC).

• Inventory whether you use LMCache (directly or as a dependency of your vLLM stack) and in which mode.
• Check the --host flag and your Kubernetes manifests: no 0.0.0.0 and no exposed service IPs.
• Apply NetworkPolicies that limit port 5555 to the pods that truly need it.
• Don’t run the process as root if you can avoid it, and don’t mount cloud credentials into it.