LMCache flaw allows unauthenticated remote code execution

JFrog said LMCache had a critical flaw in its multiprocess mode that let a crafted network message run code on the cache server. It said the issue, tracked as CVE-2026-105192, had no patched release at the time of disclosure.

The problem affected LMCache from 0.3.9 through 0.5.5, and also the 0.5.6 release candidates and the development branch. JFrog said the server was reachable from another machine only if an operator configured it to listen on a routable address.

According to JFrog, the multiprocess server used ZeroMQ without authentication and unpacked one message type with Python pickle before checking the message type. It said that let a crafted message execute code as the user running the LMCache process, and that the official container images ran that process as root.

JFrog said the flaw was found by Yuval Moravchick of its security research team. It advised operators not to expose the server on a routable address and to keep the port on a local machine or trusted cluster network.

The article also said LMCache had not published a security advisory and that JFrog’s notice did not give a way to tell whether a server had already been attacked. It added that a related vLLM flaw had been fixed in version 0.30.0.