Unpatched critical LMCache flaw lets unauthenticated attackers run code on exposed LLM cache servers

JFrog disclosed CVE-2026-105192, a critical flaw rated 9.8 in LMCache, open-source software that speeds up LLM servers such as vLLM. In multiprocess mode the cache runs as a standalone server reached over ZeroMQ with no authentication, and one message type is deserialized with pickle before its type is checked, letting a crafted message run code. The server is exposed only when an operator binds it to a routable address rather than the default localhost, and the code runs with LMCache's privileges, which are root in the project's official container images. No fix exists yet, and JFrog advises keeping the port on localhost or a trusted cluster network.

Check

Inventory LMCache deployments, confirm the ZeroMQ cache server is bound only to localhost or a trusted cluster network, and avoid exposing it on routable addresses until a fix ships.

Affected

LMCache 0.3.9 through 0.5.5 in multiprocess mode exposes an unauthenticated ZeroMQ socket that deserializes pickle data, letting a remote attacker run code as root on bound servers.

Fix

Keep the LMCache port on localhost or a trusted network, restrict network access to LLM cache hosts, and watch for an upstream patch since none is available yet.