CVE-2026-105192: LMCache (vLLM KV-Cache) Unauthenticated Remote Code Execution Vulnerability — Analysis & Mitigation

# cybersecurity# cve# vulnerability# infosec

Faizan Akhtar

Summary On October 7, 2026, JFrog Security Research disclosed CVE-2026-105192, a...

Summary

On October 7, 2026, JFrog Security Research disclosed CVE-2026-105192, a maximum-severity CVSS 9.8 flaw in LMCache — the open-source key-value cache layer bolted onto vLLM large-language-model inference servers — that lets an unauthenticated remote attacker execute arbitrary code on the cache server. The root cause is the oldest trap in application security: unsafe deserialization. In multiprocess (distributed) mode, LMCache opens a network socket with no authentication, no encryption, and no message verification — and any message it receives with a particular extension code is passed straight to Python's pickle.loads() before any handler runs. One crafted network message, and the attacker owns the process. There is no patch. As of disclosure, the LMCache maintainers had not published their own advisory, a public proof of concept was released alongside the JFrog write-up, and the only defenses are configuration changes and interim mitigations. The security of cyberspace increasingly depends on AI infrastructure that was built for research velocity, not adversarial environments — and this flaw is what that gap looks like in practice.

The exposure math is what makes this genuinely scary. LMCache's cache server binds to localhost by default — not remotely reachable. But operators routinely override that with a routable address (via --host) to scale vLLM across multiple nodes, and the project's own example Kubernetes deployment runs with hostNetwork, exposing the service on all interfaces. In those deployment shapes, CVE-2026-105192 is unauthenticated network RCE. And because official LMCache container images run the process as root, exploitation can mean full host-level control — on machines that typically also hold model weights, API keys, and customer prompts.

Severity

CVE ID: CVE-2026-105192
Title: LMCache KV-cache server — unauthenticated remote code execution via unsafe pickle deserialization (CWE-502)
CVSS 3.1: 9.8 (Critical)
Attack requirements: None — unauthenticated, remote (network-reachable in common deployment shapes), low complexity; public PoC available
Weakness: CWE-502 — Deserialization of Untrusted Data
Exploitation status: No confirmed in-the-wild exploitation and not in CISA KEV as of October 13, 2026 — but a public PoC exists and there is no patch, making this a prime pre-weaponization patching story

Affected Versions

LMCache 0.3.9 (October 2025) through 0.5.5 (latest stable)
0.5.6 release candidates and the development branch
Multiprocess (distributed) mode only — single-process deployments that do not expose the standalone cache server are not affected

Fixed version: none exists. No patched release had shipped as of disclosure; LMCache had not published its own security advisory. Treat every multiprocess deployment as vulnerable until a fixed release is announced.

Technical Analysis

The architecture of the flaw is a study in how research-grade infrastructure becomes production infrastructure without acquiring production-grade security. In multiprocess mode, LMCache runs a standalone cache server that the LLM worker processes reach over ZeroMQ. The server opens a ROUTER socket on port 5555 by default — and that socket has no CURVE encryption, no ZAP authentication, and no message verification whatsoever. Anyone who can reach the socket can talk to it, and the server will trust whatever arrives.

Messages arrive encoded as msgpack, and one particular message shape is wired directly to danger: extension code 1 is dispatched to DeviceIPCWrapper.Deserialize, which calls pickle.loads() on the attacker-controlled bytes — before any handler runs. Python's pickle is not a data format; it is a serialization of a tiny virtual machine, and unpickling untrusted bytes is functionally equivalent to executing untrusted code. A single DEALER message to the ROUTER socket therefore executes arbitrary code as the LMCache process user. There is no login to bypass, no session to steal, no second request needed.

What Is Data Integrity — and Why Pickle Breaks It

What is data integrity in this context? It is the guarantee that data arriving over a channel is the data the sender intended — unmodified, untampered, authentic. Deserialization without verification destroys that guarantee by design: the receiver reconstructs objects from bytes it never authenticated, so a tampered message is indistinguishable from a legitimate one. The safe pattern is boring and well-known — use a serializer that cannot execute code (JSON, protobuf, msgpack with a fixed schema) and authenticate the channel (TLS, CURVE, HMAC) so tampering is detectable. LMCache's multiprocess transport skipped both: pickle for the format, and nothing at all for channel integrity. The result is a textbook CWE-502 with a 9.8 score.

From Localhost to the Internet: How Deployment Shapes Create RCE

On paper, the default bind is localhost — not remotely reachable. In practice, the vulnerable population is large, because the whole point of multiprocess mode is multi-node scaling, and multi-node scaling requires a routable address. Operators pass --host with a cluster address; Helm-style deployments and the project's own example Kubernetes manifests run the cache server with hostNetwork, binding it to all interfaces. Each of these is a reasonable operational choice that quietly converts a localhost-only service into unauthenticated network RCE.

The privilege context multiplies the impact. Official LMCache container images run the cache server process as root. So the exploit chain in a typical vulnerable deployment is: one unauthenticated network message → arbitrary code execution → as root → on a host that usually also runs the vLLM workers, with access to model weights, inference API keys, and the prompts users submitted. That last item deserves emphasis: LLM inference servers process other people's data. Compromising the cache layer of a multi-tenant inference deployment is not just a host takeover — it is a data-confidentiality event.

Could a Routine Pentest Catch This?

Pentest teams reading this should treat LMCache as a case study for AI-infrastructure scoping. A routine pen test of an AI deployment that stops at the HTTP API will miss this entirely — the vulnerable socket is a separate ZeroMQ service on port 5555, not the inference endpoint. The checklist that catches it: enumerate all listening services on AI hosts (not just HTTP), fingerprint ZeroMQ/ROUTER sockets, check container processes for root execution, and test whether msgpack/pickle deserialization paths are reachable without authentication. Any AI-infrastructure pentest scope written in 2026 should name the KV-cache layer explicitly — it is now a demonstrated attack surface, not an implementation detail.

FAQ: Key Questions on CVE-2026-105192

What is data integrity, and why does pickle deserialization break it? Data integrity means received bytes are exactly what the legitimate sender produced. Pickle deserialization breaks it because unpickling executes embedded instructions from the byte stream — so a tampered message is not just corrupted data, it is attacker code running inside your process.

Is my LMCache deployment vulnerable if it only listens on localhost? Not remotely — the exploit needs network reachability to the cache server's ZeroMQ socket. But audit this honestly: check for --host overrides, hostNetwork in Kubernetes manifests, and container network modes that expose port 5555 beyond loopback.

What does vulnerable mean in the context of CVE-2026-105192? It means your multiprocess LMCache cache server will execute arbitrary attacker code from a single unauthenticated network message — with no patch available, so only configuration-level mitigations (below) close the hole.

Why This Matters

AI infrastructure is having its "everything is on the network with no auth" era — the same era web infrastructure went through a decade ago, with the same results. LLM inference stacks (vLLM, LMCache, vector databases, agent frameworks) were largely built by researchers optimizing for throughput and iteration speed, then deployed into production, multi-tenant, internet-adjacent environments without a corresponding security hardening pass. The security of cyberspace now partially rests on components like a KV-cache server that opens an unauthenticated pickle endpoint on a network port — and CVE-2026-105192 will not be the last such finding. The GitLab CI/CD regex-compiler RCE (CVE-2026-97229) from two days ago made the same point for DevOps infrastructure: the unglamorous plumbing components are where the critical unauthenticated flaws keep hiding.

The disclosure dynamics here are also worth studying. There is no vendor patch, no vendor advisory, and a public PoC — the worst possible combination for defenders, and the best possible conditions for rapid weaponization. Every day without a fixed release is a day the exploit recipe is public and the fix is not. Organizations running LMCache in multiprocess mode cannot wait for upstream; the interim mitigations below are the patch.

Mitigation

Remove network exposure immediately. Bind the LMCache cache server to localhost only and firewall port 5555 off the network. Keep the service on loopback or a trusted, isolated cluster network. Audit Kubernetes manifests for hostNetwork: true on LMCache workloads and remove it.
Do not run the cache server as root. The official images run as root, which turns RCE into full host compromise. Run the container with a dropped-privilege user (and read-only root filesystem where possible) so a deserialization exploit buys the attacker far less.
Plan the real fix: replace pickle. Per JFrog's interim guidance, the durable remediation is replacing pickle with a safe serializer (JSON, protobuf, or msgpack with a fixed schema) and adding transport authentication — CURVE or HMAC — on the ZeroMQ socket. Track the LMCache repository for the upstream fix and upgrade the moment a patched release ships.
Assume exposure and hunt. With a public PoC and no patch, any multiprocess LMCache instance reachable from untrusted networks should be treated as potentially compromised: review process and network logs for unexpected connections to port 5555, check for unknown processes or persistence on the host, and rotate API keys and credentials that transited the inference environment.
Scope AI infrastructure in security reviews. Add every auxiliary service in the inference stack — cache servers, vector DBs, model registries — to asset inventories, network segmentation policies, and pentest scopes. If a component accepts network input, it is attack surface, no matter how "internal" it was assumed to be.

References

Analysis by Faizan Akhtar, Cyber Security Researcher and Bug Bounty Hunter.

Report by Faizan Akhtar — The Cyber Security Researcher