CVE-2026-105192: LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote attack?
Deployments using LMCache multiprocess (distributed) mode are exposed when the ZeroMQ transport is reachable by an attacker. The service binds to localhost by default, but multi-node deployments can make it reachable by setting a routable address with --host.
Does exploitation require credentials or interaction from a legitimate user?
No. An attacker can send a single unauthenticated ZeroMQ DEALER message to the transport port, which defaults to 5555; no privileges or user interaction are required.
What privileges would successful code execution have?
Code executes as the user running the LMCache process. Official container images run that process as root, so exploitation of those images results in root-level code execution in the container.
How can operators identify potentially affected instances?
Check whether LMCache is running in multiprocess or distributed mode and whether its ZeroMQ transport is exposed beyond localhost, particularly through --host. Also check whether port 5555, or the configured transport port, is reachable from untrusted networks.