Key points
- Versions 0.3.9 through 0.5.5 are vulnerable to unauthenticated remote code execution.
- The flaw exists in the ZeroMQ transport used for multiprocess and distributed modes.
- No patched version has been published to PyPI as of the advisory date.
LMCache versions 0.3.9 through 0.5.5 contain a critical vulnerability that allows unauthenticated remote code execution. The flaw, identified as CVE-2026-105192, affects the multiprocess mode used for distributed key-value cache sharing. Attackers can exploit this issue by sending a single malicious message to the transport port. The vulnerability carries a CVSS score of 9.8 for configurations bound to routable network addresses.
In plain English
The LMCache software uses a communication channel called ZeroMQ to let different worker processes share data. In multiprocess mode, this channel opens on port 5555. The system does not require passwords or authentication to connect to this socket. An attacker who can reach this port can send a specially crafted message. This message triggers the processing of unsafe data using Python's Pickle library. Pickle deserialization can execute arbitrary code on the server.
The background
The vulnerability was introduced in version 0.3.9 and remains in the latest release, 0.5.5. It is also present in release candidates up to 0.5.6rc3. The issue stems from how the system handles extension code during message decoding. The deserialization hook runs before the main handler processes the request. This allows code execution during the initial registration phase. Default installations bind to localhost, limiting remote access. However, multi-node deployments often bind to 0.0.0.0 to allow peer connections.
What changes now
No fixed version has been published to PyPI. The advisory notes that the flaw persists on the development branch as of October 7, 2026. Users relying on the multiprocess feature face significant risk if their configuration exposes the transport port. Single-host installations that keep the default localhost binding are not reachable from other machines. The risk is highest for official container images, which run the LMCache process as root. Operators must review their network configurations immediately.
Who needs to act first
Teams should prioritize systems where the LMCache transport binds to a routable IP address. Check whether the service is exposed to untrusted networks or the internet. Isolate affected hosts by restricting network access to the transport port. Implement strict firewall rules to block unauthorized connections. Monitor logs for unusual registration attempts or unexpected process spawns. Prepare to roll back or disable multiprocess mode if exposure is confirmed. Test any network segmentation changes in a non-production environment first. Ensure backup procedures are current before making configuration changes.
Background: Unauthenticated remote code execution
Unauthenticated remote code execution often stems from default credentials, exposed management interfaces, and improper input handling. Fix these by enforcing strict authentication, disabling unused services, validating all inputs, and isolating privileged components from public networks.
Read the full guide: Unauthenticated RCE Mistakes: 7 Errors That Expose Your Systems
What to do and how to stay safe: LMCache
- Restrict network access to port 5555 using firewalls or security groups.
- Disable multiprocess mode if distributed caching is not strictly required.
- Monitor system logs for unauthorized connections or anomalous process activity.
- Review container configurations to ensure processes do not run as root.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which LMCache versions are affected by this vulnerability?
Versions 0.3.9 through 0.5.5 are vulnerable, including release candidates up to 0.5.6rc3.
Is there a patch available for CVE-2026-105192?
No fixed version has been published to PyPI as of the advisory date.
How is the vulnerability exploited?
Attackers send an unauthenticated message to the ZeroMQ transport port, triggering Pickle deserialization.
