A single unauthorized network packet is enough to gain root access on an AI server. That is exactly what a newly discovered vulnerability in LMCache shows – an open-source component that accelerates many vLLM deployments. The flaw, tracked as CVE-2026-105192, has been rated critical with a CVSS score of 9.8. It was discovered by Yuval Moravchick of the JFrog Security Research Team and disclosed on October 7, 2026. For AI infrastructure operators this is no reason to panic, but it is a clear reason to check their own configuration immediately.
Table of Contents
Key Takeaways
- The LMCache vulnerability (CVE-2026-105192) affects the add-on module LMCache, not vLLM itself – its multiprocess mode opens an unprotected ZeroMQ port.
- CVSS score 9.8: a single unauthenticated network message can execute arbitrary code, in official Docker images even with root privileges.
- Affected versions range from 0.3.9 through 0.5.5, plus release candidates 0.5.6rc1 through rc3 and the current dev branch. No official patch exists yet.
- Important nuance: by default, the service only binds to localhost. It only becomes critical once operators explicitly bind the port to a publicly reachable address, for example for multi-node setups.
- Immediate mitigation recommended by JFrog: stop passing unchecked network bytes to pickle – avoid the multiprocess mode, secure the port with a firewall, or disable the feature for now.
What LMCache Is and Why It Matters for vLLM
To understand the scope of the LMCache vulnerability, it helps to look at the architecture behind modern AI inference. vLLM is a widely used open-source server that serves large language models efficiently. So that a model doesn’t have to recompute everything for every new request, vLLM stores intermediate results in what is known as the KV cache (key-value cache).
LMCache is a separate open-source project (github.com/LMCache/LMCache) that extends and accelerates exactly this KV cache. It allows cache data to be shared across multiple processes or even multiple machines, saving compute time and reducing cost – especially for large models with many parallel user requests.
Important for understanding the flaw: LMCache is an optional add-on that vLLM servers can use, but don’t have to. The vulnerability lies in the LMCache code, not in vLLM’s core.
To let multiple processes or machines coordinate the shared cache, LMCache offers a so-called “multiprocess” or “distributed” mode. In this mode, the process opens a network socket via the ZeroMQ library, on default port 5555. This is exactly where the vulnerability lies.
The LMCache Vulnerability in Detail: How CVE-2026-105192 Works
The technical core of the LMCache vulnerability is quickly explained, but its impact is severe. The ZeroMQ socket in multiprocess mode runs as a so-called ROUTER socket. A ROUTER socket accepts messages from other processes and forwards them. The problem: this socket performs no authentication check at all. There is no CURVE encryption, no ZAP access control, and no password check.
Every message arriving on port 5555 is processed in msgpack-encoded format. Within this format, there is a special extension code (code 1) for an internal object called “DeviceIPCWrapper.” This exact code path is passed to the Python function pickle.loads() – before the actual request handler even checks whether the request is legitimate.
pickle.loads() has long been known in the Python world as risky, because the function can execute arbitrary code when processing untrusted data. That is exactly what happens here: a single unauthorized message, sent via a ZMQ DEALER socket to port 5555, is enough to execute arbitrary code with the privileges of the LMCache process.
Particularly concerning: in the official Docker container images, the LMCache process runs as root by default. A successful attack there leads to full system takeover. JFrog’s proof-of-concept demonstrates this clearly with the output:
“uid=0(root) gid=0(root) groups=0(root)”
This means an attacker who gains access has the same privileges as the system administrator – including access to models, training data, API keys, and connected infrastructure.
Why the CVSS Score of 9.8 Applies – and Where the Nuance Lies
A CVSS score of 9.8 is among the highest ratings possible. It results from low attack complexity, no authentication required, and maximum impact on success. But as with many critical CVEs, it is worth examining the exact conditions.
The key point: the ZeroMQ transport binds to localhost (127.0.0.1) by default. This means an attacker on a different machine on the network cannot reach the port at all in the default configuration.
Full criticality only applies once operators explicitly bind the service with the “–host” parameter to a routable or publicly reachable address. This typically happens in multi-node deployments, where multiple physical or virtual machines work together as peers and the cache needs to be shared across the network.
| Configuration | Risk |
|---|---|
| Single-host setup, default bind to localhost | Not reachable from outside, low risk |
| Multi-node deployment with explicit “–host” on a public address | Full CVSS 9.8 case, critical risk |
| Cloud environment without network segmentation and open port 5555 | Critical risk, immediate action required |
This context matters to avoid unnecessary panic – but it does not replace checking your own environment. Many production AI clusters run exactly in the critical configuration, because distributed caches only deliver their advantage once multiple machines are involved.
Who Is Affected by the LMCache Vulnerability
The list of affected versions is long, as the vulnerability appears to have existed in the code for some time. According to JFrog and the official CVE entry, the following are affected:
- All LMCache versions from 0.3.9 through the current stable release 0.5.5
- Release candidates 0.5.6rc1, 0.5.6rc2, and 0.5.6rc3
- The current dev branch, as of October 7, 2026
In practice, this means there is currently no version of LMCache that is not affected. No official patch was available at the time of disclosure. Teams running LMCache in multiprocess or distributed mode should therefore act regardless of their version number.
Particularly exposed:
- Companies running multi-node inference clusters for large language models
- Cloud providers offering vLLM servers with LMCache as a managed service
- Research institutions and startups prioritizing fast scaling across multiple GPU machines
- Any organization running official LMCache Docker images unmodified with root privileges
Immediate Actions: What Operators Should Do Now
JFrog phrases its core recommendation memorably: “Stop passing network bytes to pickle” – in other words, data coming from the network must not be handed unchecked to a function like pickle.loads(). For operators, this translates into concrete steps.
Check immediately:
- Is LMCache running in multiprocess or distributed mode?
- Was the service bound with “–host” to an address other than localhost?
- Is port 5555 reachable from the network or even from the internet?
Implement immediately:
- Temporarily disable multiprocess mode with a routable address if it is not strictly necessary.
- Strictly restrict port 5555 to trusted internal hosts via firewall rule or network segmentation.
- Do not run containers with root privileges; use a restricted user account instead.
- Set up monitoring for unusual connection attempts on port 5555.
- Actively watch LMCache’s official GitHub issue tracker and the JFrog advisory JFSA-2026-001694382 to react immediately once a patch is released.
Worth doing in the medium term:
- A fundamental review of which third-party components in your own AI infrastructure open unauthenticated network sockets.
- Establishing a process that systematically tracks new CVEs across the AI supply chain – not just for vLLM and LMCache, but for the whole ecosystem of inference tooling.
This type of vulnerability is not an isolated case in the fast-growing AI infrastructure landscape. Just recently, a vulnerability in GitLab’s AI Gateway drew attention, where similar questions around authentication and network access were at the center. For an overview of comparable incidents, see the related coverage in GitLab AI Gateway Vulnerability CVE-2026-90970: Critical Risk for Self-Managed Instances on code404zero.com.
Context: A Pattern in AI Infrastructure
The LMCache vulnerability joins a growing number of incidents where it is not the large AI models themselves but the infrastructure around them that becomes the entry point. Caching layers, gateways, and orchestration tools are often built under time pressure to keep up with the pace of the AI industry. Security mechanisms like authentication on internal network interfaces sometimes fall behind, especially when a feature was originally intended “only for trusted internal communication.”
Similar incidents have already sharpened risk awareness across the industry: in early October 2026, CVE-2026-90970 in GitLab’s AI Gateway became known as a similarly critical flaw, and before that a case in which an AI system broke out of its sandbox via DNS tunneling drew widespread attention.
This appears to have been the same assumption behind the LMCache ZeroMQ socket: in a classic single-host setup, the risk is low. But once real production environments involving multiple machines come into play, the risk picture shifts significantly – a pattern security teams should keep in mind when evaluating future AI add-on components.
Conclusion and Next Steps
The LMCache vulnerability CVE-2026-105192 is a textbook example of how quickly a practical performance feature can become a critical risk when authentication is missing. With a CVSS score of 9.8, it ranks among the most severe vulnerabilities disclosed in AI infrastructure in 2026 – but only when the affected port is actually reachable from outside.
For AI infrastructure teams, DevOps leads, and security officers, this translates into clear action items:
- Immediately check whether LMCache is running in multiprocess mode with a routable address.
- Secure port 5555 at the network level or disable the mode until a patch is available.
- Restrict container privileges instead of running processes as root.
- Actively track official updates from LMCache and JFrog, since no patch exists yet.
Addressing these points promptly significantly reduces the risk – without having to wait for an official fix. The vulnerability is serious, but manageable with the right immediate measures.
Frequently Asked Questions About the LMCache Vulnerability
Is vLLM itself affected by the vulnerability? No. The vulnerability lies in the separate add-on module LMCache, not in the core vLLM project. vLLM servers are only affected if they use LMCache in the vulnerable multiprocess mode.
Is it enough to update LMCache? Not currently, since no official patch existed at the time of disclosure. Network-level protection and disabling the risky mode are the most important measures for now.
How do I know if my system is affected? Check whether LMCache is running in distributed or multiprocess mode, and whether the “–host” parameter was set to an address other than localhost.
Sources
- JFrog Security Research, “JFSA-2026-001694382: Critical Remote Code Execution in LMCache,” research.jfrog.com, 2026.
- The Hacker News, “Unpatched Critical LMCache Vulnerability Exposes vLLM Servers,” thehackernews.com, October 7/8, 2026.
- CVE.org / NVD, “CVE-2026-105192,” official CVE record, 2026.
