CVE-2026-105192 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-105192 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-105192 is a critical unauthenticated remote code execution flaw in LMCache multiprocess/distributed mode. A single crafted ZeroMQ message sent to the transport port can trigger pickle.loads() during message deserialization, before request handling and without authentication. In default official containers, the LMCache process runs as root, which can turn one packet into full container takeover.

This is especially urgent for solo developers and small teams running local dev stacks, shared test boxes, or multi-node deployments with --host exposed beyond localhost. Even though there is no known exploitation in the wild and it is not in CISA KEV, the attack path is simple and the severity is CRITICAL (CVSS 9.8).

Immediate Action

  • Disable LMCache multiprocess/distributed mode now unless you absolutely need it. If possible, stop the service and roll back to single-process/local mode.
  • Block access to the transport port (default 5555) at the host firewall and container/network layer. Do not expose it on routable interfaces.
  • Upgrade to the first fixed release as soon as the vendor publishes it. See the vendor advisory: TODO: vendor advisory link.
  • Run LMCache as a non-root user in containers and on hosts until patched. Root increases impact dramatically.
  • For multi-node setups, isolate the transport network so only trusted peers can connect. Treat the port as fully unauthenticated.
  • If you cannot patch immediately, remove the feature or replace the deployment with a non-distributed configuration.

Affected Versions

  • lmcache@TODO_VULNERABLE_VERSION_RANGE vulnerable; upgrade to TODO_FIXED_VERSION or later.
  • lmcache-server@TODO_VULNERABLE_VERSION_RANGE vulnerable; upgrade to TODO_FIXED_VERSION or later.
  • lmcache official container images built from vulnerable releases are vulnerable; use TODO_FIXED_IMAGE_TAG or later.
  • TODO_ANY_RELATED_PACKAGE@TODO_RANGE vulnerable if it enables multiprocess/distributed mode and exposes the ZeroMQ transport.

Resolution Guide

1) Patch or upgrade immediately. Use the package manager you actually deploy with:

# npm / yarn / pnpm
npm i lmcache@TODO_FIXED_VERSION
yarn add lmcache@TODO_FIXED_VERSION
pnpm add lmcache@TODO_FIXED_VERSION

# Python
pip install --upgrade lmcache==TODO_FIXED_VERSION
pipx upgrade lmcache

# Java (if wrapped or embedded in a service artifact)
mvn versions:use-dep-version -Dincludes=TODO_GROUP:TODO_ARTIFACT -DdepVersion=TODO_FIXED_VERSION
./gradlew dependencyUpdates

# Linux packages
sudo apt-get update
sudo apt-get install --only-upgrade lmcache
sudo yum update lmcache

# Docker
docker pull TODO_REGISTRY/lmcache:TODO_FIXED_IMAGE_TAG
docker run --rm TODO_REGISTRY/lmcache:TODO_FIXED_IMAGE_TAG

2) Harden the deployment if you must keep it online before patching.

# Bind only to localhost if you do not need remote peers
lmcache --host 127.0.0.1 --port 5555

# Or disable distributed/multiprocess mode entirely
lmcache --single-process

# Example container hardening
docker run --user 1000:1000 --cap-drop ALL --security-opt no-new-privileges \
  -p 127.0.0.1:5555:5555 TODO_REGISTRY/lmcache:TODO_FIXED_IMAGE_TAG

3) Code-level mitigation example. If your code directly handles this transport, reject extension code 1 and remove pickle-based deserialization from unauthenticated paths.

# Pseudocode patch: never call pickle.loads on unauthenticated transport data
def deserialize(msg):
    ext_code, payload = parse_msgpack(msg)
    if ext_code == 1:
        raise ValueError("Blocked unsafe extension code")
    return safe_decode(payload)

Detection & Verification

Check whether you are vulnerable:

# Find LMCache version
python -c "import lmcache; print(lmcache.__version__)" 2>/dev/null

# Check installed packages
pip show lmcache
pip freeze | grep -i lmcache

# Search container/image metadata
docker images | grep -i lmcache

# Look for distributed mode or transport binding in configs
grep -RInE "host|5555|distributed|multiprocess|ZeroMQ|zmq" /etc /opt /app 2>/dev/null

Verify the fix:

# Confirm the patched version is installed
pip show lmcache
python -c "import lmcache; print(lmcache.__version__)"

# Confirm the service is not listening on a routable interface
ss -lntp | grep 5555
netstat -lntp | grep 5555

# Confirm container is not root
docker inspect TODO_CONTAINER | grep -i '"User"'

Dependency auditing: run your normal scanner and look for LMCache in the dependency tree.

pip-audit
npm audit
yarn audit
pnpm audit
mvn dependency:tree
./gradlew dependencies

Risk and Impact

Successful exploitation gives an attacker code execution as the user running the LMCache process. In the official container setup, that may be root, which can mean full container compromise, data theft from attached volumes, and pivoting into neighboring services if the container is over-privileged. For small teams, the most likely blast radius is the application host, local secrets, cached model data, and any internal network access granted to the service.

If you expose the transport port beyond localhost for multi-node operation, treat it as internet-grade risk unless protected by strict network controls. Patch or isolate first, then re-enable only after you have confirmed the fixed release and hardened runtime settings.

Keep reading