Critical LMCache Vulnerability Allows Unauthorized Code Execution

A newly released proof-of-concept (PoC) exploit highlights a severe vulnerability in LMCache, which potentially allows remote code execution without authentication in distributed setups. This flaw, identified as CVE-2026-105192, boasts a critical CVSS score of 9.8 and affects LMCache versions starting from 0.3.9. As of early October, no fix has been issued, according to JFrog Security Research.

Understanding the Vulnerability

The vulnerability, discovered by Yuval Moravchick from JFrog Security, is found in LMCache’s multiprocess mode. This setup utilizes a ZeroMQ (ZMQ) service to enable multiple processes to share cache data effectively. The risk escalates when the service is configured to operate over a network address accessible by multiple nodes.

LMCache often supports large language model inference systems by optimizing performance through cache data reuse. However, JFrog’s research revealed a security gap in its ZMQ transport, which accepts unauthenticated messages, leaving it susceptible to manipulation.

Technical Details and Risks

The core of the issue lies in the service’s use of MessagePack (msgpack) for data handling, which involves the DeviceIPCWrapper.Deserialize function invoking Python’s pickle.loads. This practice is unsafe as it permits execution of arbitrary code from untrusted data sources. Consequently, an attacker can dispatch a crafted message to execute harmful code.

The PoC demonstrates that a ZeroMQ DEALER message, sent to the default port 5555, can be exploited to execute commands on the server. Alarmingly, in default container images of LMCache, this process runs with root privileges, increasing the potential impact of an attack.

Preventive Measures and Recommendations

JFrog advises against exposing multiprocess services to public networks. Instead, these should be restricted to localhost or secured networks. For a long-term solution, it is recommended to replace pickle.loads for network data, choose safer serialization formats, and implement strong authentication measures like ZeroMQ CURVE.

Organizations utilizing LMCache in AI environments should urgently assess their network configurations, ensure port 5555 is not exposed, and operate services with minimal privileges. The flaw underscores the need for robust security measures in AI and machine learning infrastructures.

The highlighted vulnerability in LMCache exemplifies the critical need for secure coding practices in software development, particularly in AI-related fields, where exposed services can have far-reaching consequences.