---
id: "2026-10-07-lmcache-cve-unauthenticated-rce"
url: "https://postcutoff.com/e/2026-10-07-lmcache-cve-unauthenticated-rce/"
as_of: "2026-10-10T14:45:00+02:00"
date: "2026-10-07"
date_precision: day
category: policy-safety
importance: 2
confidence: high
status: [Confirmed]
sources: 1
editor: Adam Bicz
human_review: null
version: "2026-10-10"
---

As of: 2026-10-10 14:45 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code). Human editor: Adam Bicz.
Canonical page: https://postcutoff.com/e/2026-10-07-lmcache-cve-unauthenticated-rce/

# JFrog discloses unpatched critical RCE in LMCache, the KV-cache layer used with vLLM

Full title: JFrog discloses unpatched critical RCE in LMCache, the KV-cache layer used with vLLM (CVE-2026-105192, CVSS 9.8)

On Oct 7, 2026 JFrog disclosed CVE-2026-105192 in LMCache, an open-source KV-cache layer used with vLLM for distributed LLM serving. Its multiprocess mode exposes an unauthenticated ZeroMQ socket (port 5555 by default) whose messages reach pickle.loads, so anyone who can reach the port can run code, typically as root in the official containers. No fix existed at disclosure.

## Key facts
- CVE-2026-105192, CVSS 9.8; affects LMCache >= 0.3.9; no fixed version as of Oct 7, 2026 (JFrog)
- Cause: msgpack extension code 1 is registered for DeviceIPCWrapper, whose Deserialize calls pickle.loads on data from an unauthenticated ZMQ ROUTER socket
- Impact: arbitrary code execution with the LMCache process's privileges, typically root in official container images
- Mitigation: do not bind the multiprocess port to routable addresses (no --host with a routable IP); keep it on trusted, firewalled cluster networks

## What happened

JFrog's security research team published an advisory for LMCache's multiprocess ZeroMQ transport: crafted messages are unpickled
without authentication, giving remote code execution.

## Why it matters

LLM-serving stacks reuse Python serialization shortcuts that are unsafe on a network. Compromised inference nodes can expose model weights,
prompts and customer data. Check whether a patched release has shipped before relying on the mitigation advice.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 160 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 99 days after its cutoff
- Gemini 3.8 Flash (training cutoff March 2026): 190 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 129 days after its cutoff

## Sources

1. [JFrog Security Research: LMCache unauthenticated RCE via pickle deserialization (CVE-2026-105192)](https://research.jfrog.com/vulnerabilities/lmcache-is-vulnerable-to-unauthenticated-remote-code-execution-via-pickle-deserialization-on-the-multiprocess-zmq-transport-cve-2026-105192-jfsa-2026-001694382/) (research.jfrog.com, official)

## Changes

- 2026-10-10 (filed): Created from data/leads.md