Critical, CVSS 9.8PyPIAmendedPublished
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
CVE-2026-105192 · GHSA-w5f2-9q9c-ff4h
- Affected
- PyPI lmcache >= 0.3.9, < 0.5.6
- Fixed in
- 0.5.6· Vendor fix available
- Issue
- LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport Details LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. The intended clients are sibling LMCache processes. There is no CURVE, ZAP, password, or message authentication on that socket. LMCache used only inside a vLLM process does not open this port. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect. The 9.8 score is for that routable configuration. A stock single-host install that leaves the default bind is not reachable from other machines. Messages on the socket are msgpack. Extension code 1 is registered for DeviceIPCWrapper and is passed to DeviceIPCWrapper.Deserialize in lmcache/v1/platform/base/ipcwrapper.py, which calls pickle.loads. That hook runs…
Recommended action: Upgrade to 0.5.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.