Threat reportVulnerabilityTL-2026-3018
Unpatched Critical LMCache Flaw (CVE-2026-105192) Lets Unauthenticated Attackers Run Code Remotely via Pickle Deserialization
Unpatched Critical LMCache Flaw (CVE-2026-105192) Lets (TL-2026-3018), also tracked as JFSA-2026-001694382, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-07 and last reviewed 2026-10-09. It has no confirmed attribution, affects LMCache LMCache (multiprocess ZMQ transport), references 1 CVE (CVE-2026-105192), maps to 10 MITRE ATT&CK techniques (T1005, T1033, T1046), and is covered by 9 detection rules and 16 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-3018
- Threat ID
- TL-2026-3018
- Also known as
- JFSA-2026-001694382
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud-services, ai-ml
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
- Updates
- 2026-10-09 · revalidated 1× · latest source
Malware and tooling in Unpatched Critical LMCache Flaw (CVE-2026-105192) Lets
Malware and tooling: Python
How Unpatched Critical LMCache Flaw (CVE-2026-105192) Lets works
A critical unauthenticated remote code execution flaw in LMCache's multiprocess mode (ZeroMQ transport) lets a single crafted network message to an exposed cache server execute code via pickle deserialization, with the LMCache process privileges (root on official containers). No fixed version exists. Exploitation requires the server to listen on a routable address rather than the localhost default.
CVE-2026-105192 (JFrog advisory JFSA-2026-001694382, CVSS 9.8) affects LMCache, the open-source (Apache-2.0) KV-cache management layer used alongside LLM inference engines such as vLLM. LMCache's multiprocess (MP) architecture, released in April 2026, runs the cache as a standalone daemon so cached state survives an inference-engine crash. In this mode the server opens a ZeroMQ socket (default port 5555) on which worker processes register and share cached data. That socket has no authentication.
Root cause: the transport registers msgpack extension code 1 for DeviceIPCWrapper and passes it to DeviceIPCWrapper.Deserialize in lmcache/v1/platform/base/ipc_wrapper.py, which calls pickle.loads. Deserialization of attacker-supplied bytes therefore happens before any message-type validation. A single unauthenticated ZMQ DEALER message carrying a msgpack frame with a malicious pickle payload executes arbitrary Python code with the privileges of the LMCache process, which is root in the official containers.
Exposure condition: the default bind is localhost, which is not remotely exploitable. The server is reachable only when started with --host set to a routable address (all interfaces), as happens in Kubernetes and multi-node deployments where workers on other nodes must reach the cache. Affected: LMCache 0.3.9 (October 2025) through 0.5.5, the 0.5.6 release candidates (v0.5.6rc3) and the dev branch as of 2026-10-07. No patched version exists, LMCache has published no security advisory, and no remediation timeline was given. JFrog notes its disclosure offers no method to detect prior compromise.
Context: six further security reports were filed against the LMCache GitHub repository on 2026-10-06, covering unauthenticated cross-tenant access to cached data, unauthenticated network services executing commands, and an HTTP admin server bound to all interfaces in v0.5.5 (reported fixed in the 0.5.6 candidates). A separate vLLM bug, CVE-2026-105756 (malformed cache_salt causing DoS on LMCache multiprocess deployments, CVSS 6.5), was patched in vLLM 0.30.0 on 2026-09-22. The flaw follows the 'ShadowMQ' pattern Oligo Security described in November 2025 (unauthenticated ZMQ sockets + recv_pyobj/pickle) that hit Meta Llama Stack (CVE-2024-50050), vLLM (CVE-2025-30165), NVIDIA TensorRT-LLM (CVE-2025-23254) and Modular Max Server (CVE-2025-60455). Oligo also reported thousands of exposed unencrypted ZMQ sockets on the public internet from that class.
Evidence status: the source reports no evidence of in-the-wild exploitation, no public proof-of-concept and no published IOCs. The CVSS vector shown is the standard 3.1 vector consistent with the published 9.8 score (network, low complexity, no privileges, no user interaction); the sources give only the score. CWE-502 and CWE-306 are analyst classifications from the described root cause. Because the vulnerability class is well understood and the exploit is a single message, defenders should treat any LMCache MP server bound to a routable address as exposed.
MITRE ATT&CK techniques used in TL-2026-3018
Collection
Discovery
T1033 System Owner/User Discovery; T1046 Network Service Discovery
Execution
T1059.004 Command and Scripting Interpreter; T1059.006 Command and Scripting Interpreter: Python
Command and Control
Initial Access
T1190 Exploit Public-Facing Application
Impact
Resource Development
T1587.004 Develop Capabilities
Reconnaissance
Affected products and versions in Unpatched Critical LMCache Flaw (CVE-2026-105192) Lets
- LMCache — LMCache (multiprocess ZMQ transport)
Vulnerable versions: 0.3.9 through 0.5.5; 0.5.6 release candidates (v0.5.6rc3); dev branch as of 2026-10-07
Remediation for Unpatched Critical LMCache Flaw (CVE-2026-105192) Lets
Patches
- No fixed version available as of 2026-10-07; 0.5.6 release candidates and dev branch remain affected by this flaw
Immediate actions
- Do not assign the LMCache multiprocess server a routable address; keep --host on localhost or a trusted internal interface
- Firewall the ZMQ transport port (default 5555) to trusted cluster networks only
- Inventory Kubernetes Services, NodePorts and LoadBalancers exposing the LMCache MP port and remove external exposure
- Do not run the LMCache container as root where avoidable
Workarounds
- Run the cache and inference engine on the same host bound to localhost
- Restrict port access with firewall rules (reduces but does not eliminate risk)
Longer-term hardening
- Replace pickle with a safe serialization format on the transport
- Add transport authentication (CURVE, HMAC or password-based) and refuse routable bindings without it
- Apply NetworkPolicy / service-mesh segmentation between inference workers and cache services
- Monitor the upstream LMCache repository for a fixed release and the six related security reports
CVEs associated with Unpatched Critical LMCache Flaw (CVE-2026-105192) Lets
Weaknesses (CWE) in Unpatched Critical LMCache Flaw (CVE-2026-105192) Lets
Timeline of Unpatched Critical LMCache Flaw (CVE-2026-105192) Lets
- October 2024: Meta Llama Stack CVE-2024-50050 disclosed, the first of the ZeroMQ recv_pyobj/pickle flaws later grouped by Oligo as ShadowMQ
- October 2025: LMCache 0.3.9, the earliest affected version, is released
- Oligo Security publishes ShadowMQ research on unauthenticated ZMQ + pickle RCE across vLLM, TensorRT-LLM, Modular Max and Sarathi-Serve, noting thousands of exposed ZMQ sockets on the internet
- April 2026: LMCache releases the multiprocess architecture that introduces the standalone ZMQ cache server
- vLLM 0.30.0 patches CVE-2026-105756, a malformed cache_salt DoS affecting LMCache multiprocess deployments (CVSS 6.5)
- Six additional security reports are filed on the LMCache GitHub repository, covering cross-tenant cache access, unauthenticated command-executing services and an all-interfaces HTTP admin server in v0.5.5
- Public proof-of-concept exploit published on GitHub (rxsklife/CVE-2026-105192) the same day as disclosure; supports command execution, reverse shell, remote payload fetch-and-execute, probing and batch scanning.
- CVE-2026-105192 published in NVD with CVSS 3.1 9.8 (CWE-306, CWE-502).
- JFrog Security Research (Yuval Moravchick) publishes JFSA-2026-001694382 / CVE-2026-105192; no patched version, no vendor advisory, no known exploitation or public PoC; The Hacker News reports the same day
- Cyber Security News, Cyberpress, Mallory and other outlets report the public PoC; still no patched version and no confirmed in-the-wild exploitation.
Update history for TL-2026-3018
- 2026-10-09 — LMCache Unauthenticated RCE via Unsafe Pickle Deserialization on Multiprocess ZeroMQ Transport (CVE-2026-105192): What changed Exploitability THEORETICAL → POC_PUBLIC after a public GitHub PoC (rxsklife/CVE-2026-105192) appeared on 2026-10-07. Severity (CRITICAL / CVSS 9.8) unchanged; still no patched version. New indicators (10) PoC artifacts (/tmp/zm
Sources cited for Unpatched Critical LMCache Flaw (CVE-2026-105192) Lets
- The Hacker News: Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely
- JFrog Advisory JFSA-2026-001694382: LMCache unauthenticated RCE via pickle deserialization on the multiprocess ZMQ transport (CVE-2026-105192)
- CVE Record CVE-2026-105192
- LMCache GitHub repository
- LMCache on PyPI
- Oligo Security: ShadowMQ - How Code Reuse Spread Critical Vulnerabilities Across the AI Ecosystem
- The Hacker News: Researchers Find Serious AI Bugs Exposing Meta, Nvidia, and Microsoft Inference Frameworks
Detection coverage for TL-2026-3018
As of 2026-10-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3018 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.