# Unpatched Critical LMCache Flaw (CVE-2026-105192) Lets Unauthenticated Attackers Run Code Remotely via Pickle Deserialization

> A critical unauthenticated remote code execution flaw in LMCache's multiprocess mode (ZeroMQ transport) lets a single crafted network message to an exposed cache server execute code via pickle deserialization, with the LMCache process privileges (root on official containers). No fixed version exists. Exploitation requires the server to listen on a routable address rather than the localhost default.

- **Published:** 2026-10-07T00:00:00Z
- **Last reviewed:** 2026-10-09T05:42:24.808Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3018
- **ID:** TL-2026-3018
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-105192

## Description

CVE-2026-105192 (JFrog advisory JFSA-2026-001694382, CVSS 9.8) affects LMCache, the open-source (Apache-2.0) KV-cache management layer used alongside LLM inference engines such as vLLM. LMCache's multiprocess (MP) architecture, released in April 2026, runs the cache as a standalone daemon so cached state survives an inference-engine crash. In this mode the server opens a ZeroMQ socket (default port 5555) on which worker processes register and share cached data. That socket has no authentication.

Root cause: the transport registers msgpack extension code 1 for DeviceIPCWrapper and passes it to DeviceIPCWrapper.Deserialize in lmcache/v1/platform/base/ipc_wrapper.py, which calls pickle.loads. Deserialization of attacker-supplied bytes therefore happens before any message-type validation. A single unauthenticated ZMQ DEALER message carrying a msgpack frame with a malicious pickle payload executes arbitrary Python code with the privileges of the LMCache process, which is root in the official containers.

Exposure condition: the default bind is localhost, which is not remotely exploitable. The server is reachable only when started with --host set to a routable address (all interfaces), as happens in Kubernetes and multi-node deployments where workers on other nodes must reach the cache. Affected: LMCache 0.3.9 (October 2025) through 0.5.5, the 0.5.6 release candidates (v0.5.6rc3) and the dev branch as of 2026-10-07. No patched version exists, LMCache has published no security advisory, and no remediation timeline was given. JFrog notes its disclosure offers no method to detect prior compromise.

Context: six further security reports were filed against the LMCache GitHub repository on 2026-10-06, covering unauthenticated cross-tenant access to cached data, unauthenticated network services executing commands, and an HTTP admin server bound to all interfaces in v0.5.5 (reported fixed in the 0.5.6 candidates). A separate vLLM bug, CVE-2026-105756 (malformed cache_salt causing DoS on LMCache multiprocess deployments, CVSS 6.5), was patched in vLLM 0.30.0 on 2026-09-22. The flaw follows the 'ShadowMQ' pattern Oligo Security described in November 2025 (unauthenticated ZMQ sockets + recv_pyobj/pickle) that hit Meta Llama Stack (CVE-2024-50050), vLLM (CVE-2025-30165), NVIDIA TensorRT-LLM (CVE-2025-23254) and Modular Max Server (CVE-2025-60455). Oligo also reported thousands of exposed unencrypted ZMQ sockets on the public internet from that class.

Evidence status: the source reports no evidence of in-the-wild exploitation, no public proof-of-concept and no published IOCs. The CVSS vector shown is the standard 3.1 vector consistent with the published 9.8 score (network, low complexity, no privileges, no user interaction); the sources give only the score. CWE-502 and CWE-306 are analyst classifications from the described root cause. Because the vulnerability class is well understood and the exploit is a single message, defenders should treat any LMCache MP server bound to a routable address as exposed.

## MITRE ATT&CK

- T1046 Network Service Discovery
- T1190 Exploit Public-Facing Application
- T1059.006 Command and Scripting Interpreter: Python
- T1005 Data from Local System
- T1496 Resource Hijacking
- T1595.002 Active Scanning
- T1059.004 Command and Scripting Interpreter
- T1033 System Owner/User Discovery
- T1105 Ingress Tool Transfer
- T1587.004 Develop Capabilities

## Sources

- [The Hacker News: Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely](https://thehackernews.com/2026/10/unpatched-critical-lmcache-flaw-lets.html)
- [JFrog Advisory JFSA-2026-001694382: LMCache unauthenticated RCE via pickle deserialization on the multiprocess ZMQ transport (CVE-2026-105192)](https://research.jfrog.com/vulnerabilities/lmcache-is-vulnerable-to-unauthenticated-remote-code-execution-via-pickle-deserialization-on-the-multiprocess-zmq-transport-cve-2026-105192-jfsa-2026-001694382/)
- [CVE Record CVE-2026-105192](https://www.cve.org/CVERecord?id=CVE-2026-105192)
- [LMCache GitHub repository](https://github.com/LMCache/LMCache)
- [LMCache on PyPI](https://pypi.org/project/lmcache/)
- [Oligo Security: ShadowMQ - How Code Reuse Spread Critical Vulnerabilities Across the AI Ecosystem](https://www.oligo.security/blog/shadowmq-how-code-reuse-spread-critical-vulnerabilities-across-the-ai-ecosystem)
- [The Hacker News: Researchers Find Serious AI Bugs Exposing Meta, Nvidia, and Microsoft Inference Frameworks](https://thehackernews.com/2025/11/researchers-find-serious-ai-bugs.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3018