Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely

Security researchers at JFrog have disclosed a critical, still-unpatched vulnerability in LMCache, the open-source caching layer used to accelerate LLM inference servers like vLLM. Tracked as CVE-2026-105192 and rated 9.8 out of 10, the bug lets an unauthenticated attacker execute arbitrary code on the cache server simply by sending a crafted network message.

The issue lies in LMCache's multiprocess mode, where worker processes communicate with a standalone cache server over ZeroMQ. That server deserializes certain incoming messages using Python's pickle format before validating them, so a malicious payload can trigger code execution with the privileges of the LMCache process — which runs as root in the project's official container images. Exploitation requires the server to be bound to a network-reachable address rather than localhost, a configuration used in LMCache's own example Kubernetes deployment.

The flaw affects LMCache versions 0.3.9 through 0.5.5, as well as the 0.5.6 release candidates and the development branch, with no fixed version currently available. JFrog recommends avoiding routable addresses for the multiprocess server and restricting network access until a patch is released. Separately, six unconfirmed security reports against LMCache surfaced on GitHub, and a related, already-patched vLLM denial-of-service bug (CVE-2026-105756) was fixed in version 0.30.0.