Log in Start free

Vulnerability · Published Oct 7, 2026 · Assigned by JFROG

CVE-2026-105192LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization

Critical 9.8

In plain English

A critical-severity unsafe deserialization in LMCache from LMCache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.0%top 36.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect. The decode path shipped in v0.3.9 and is present through v0.5.5, including the v0.5.6 release candidates. v0.5.6, published on 2026-10-14, removes pickle.loads from this path.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIlmcache0.5.6GHSA-w5f2-9q9c-ff4h

Affected products (as reported)

VendorProductVersions
LMCache LMCache 0.3.9 – before 0.5.6

Weakness: CWE-502, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References