LMCache: Unauthenticated remote code execution via pickle deserialization

Summary

LMCache in multiprocess (distributed) mode opens an unauthenticated ZeroMQ transport. Incoming messages are decoded with pickle.loads, so a single crafted message to the transport port (default 5555) can execute code as the user running LMCache, which is root in the official container images. The transport binds to localhost by default, so the risk applies mainly when a routable address is set with --host, as multi-node deployments do. Versions 0.3.9 to 0.5.5 and the 0.5.6 release candidates are affected.

Affected

• LMCache 0.3.9 up to but not including 0.5.6, in multiprocess mode
• Exposed when the transport binds a routable address (--host)
• Default localhost binding is not exposed
• The v0.5.6 example Kubernetes deployment still binds 0.0.0.0

Fixed in

• LMCache 0.5.6 or later (PR #5644). Upgrade workers and servers together, as the wire format has changed.
• The official v0.5.6 images still run as root. Non-root images and the localhost binding in the example deployment are included in v0.5.7rc2.

Workaround

• Keep the transport on localhost and do not set a routable --host unless it is required
• Restrict port 5555 (or the configured port) to known peers with network policies or host firewall rules
• Run the LMCache process as a non-root user
• Review deployments based on the old Kubernetes example, which bound all interfaces

Exploitation

• No in-the-wild exploitation known at the time of writing.
• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• The JFrog write-up includes a proof-of-concept section.

Our recommendation

• Inventory LMCache installations (pip, containers, vLLM or SGLang integrations) and check the --host setting and whether port 5555 is reachable.
• Upgrade to 0.5.6 or later. If an upgrade is not possible at once, restrict the port immediately.
• Run as non-root and confirm the running version after the upgrade.
• If the port was reachable from untrusted networks, check for unexpected child processes, shells or outbound connections and treat the host as potentially compromised.
• Track the open follow-up items: RPC authentication (planned for 0.5.7) and pickle use on the engine-driven path (planned before 0.5.8).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (2 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  rxsklife/CVE-2026-105192 · basesixtythree/B63-POC-CVE-2026-105192

Research sources

• LMCache blog: An Update on CVE-2026-105192 blog.lmcache.ai
• LMCache GitHub Security Advisory GHSA-w5f2-9q9c-ff4h github.com
• LMCache release v0.5.6 github.com
• LMCache PR #5644: replace pickle in device IPC descriptors github.com
• LMCache PR #5684: bind example Kubernetes deployment to localhost github.com
• LMCache PR #5685: run official images as non-root user github.com
• JFrog Security Research write-up research.jfrog.com
• LMCache v0.5.5 ipc_wrapper.py github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:52.