The Pulse
JFrog Finds Unauthenticated Code Execution Flaw in LMCache
JFrog disclosed CVE-2026-105192, a critical remote-code-execution flaw in LMCache’s multiprocess ZeroMQ transport. The vulnerability affects versions 0.3.9 and later, but remote exposure depends on whether operators bind the transport to a
AI.info Team · Written with AI ·
Distributed sharing creates the exposure
LMCache’s multiprocess mode is designed to let worker processes register and share KV-cache blocks; JFrog says that same connection can expose a server to unauthenticated remote code execution. The security research firm disclosed the flaw, CVE-2026-105192, on October 7, assigning it a CVSS score of 9.8. The severity applies to deployments where the ZeroMQ transport is reachable over a routable network, not every LMCache installation.
LMCache describes itself as a KV-cache management layer for large language model inference. Its multiprocess mode, also called distributed mode, opens a ZeroMQ ROUTER socket for communication between LMCache workers. JFrog says the socket has no authentication through CURVE, ZAP, a password, or message authentication.
One message reaches unsafe deserialization
The flaw sits in the handling of messages sent over that socket. The transport receives MessagePack data, then passes a particular extension value to a deserialization routine that calls Python’s pickle.loads. JFrog says this happens as the server decodes a registration request, before its request handler runs.
As a result, one unauthenticated ZeroMQ DEALER message can execute code with the privileges of the LMCache process. The default transport port is 5555, and JFrog says official container images run the process as root. The vulnerable code first shipped in version 0.3.9; as of the advisory’s October 7 update, JFrog found it in the latest PyPI release, 0.5.5, in release candidates through 0.5.6rc3, and on the development branch.
Localhost binding narrows remote access
The default network setting materially changes the risk. JFrog says the transport binds to localhost unless an operator sets a routable address with --host, a setting used to connect workers across multiple machines. A stock single-host installation left at its default is not reachable from other machines through this port, and LMCache used only inside a vLLM process does not open it.
Those limits do not make an exposed multiprocess deployment safe: any host that can connect to the socket can trigger code execution, JFrog says. The CVSS 9.8 score reflects the routable configuration, where the attack requires no prior privileges or user interaction. The firm’s proof of concept demonstrates a command running as the LMCache service user.
JFrog lists no fixed release
JFrog said no fixed release was available when it published the advisory. It recommends replacing the serializer with a safe format and not passing network data to pickle; it also recommends authenticating the ZeroMQ transport, for example with CURVE or an HMAC on each message.
Until a release addresses the flaw, JFrog advises operators not to bind the multiprocess transport to a routable address. Its guidance is to keep the port on localhost or a trusted cluster network and restrict access with a firewall. A firewall can reduce which systems reach the service, but it does not replace authentication: any system still able to connect can run code as the LMCache process.