Read the docs
TI-2026-69101 Aliases CVE-2026-105192GHSA-vv44-hjm2-qw2fGHSA-w5f2-9q9c-ff4h

Unauthenticated remote code execution in LMCache multiprocess mode

Priority MEDIUM 51CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306 and CWE-502.

Summary

LMCache from 0.3.9 before 0.5.6 is affected, including the lmcache PyPI package. Multiprocess mode opens an unauthenticated ZeroMQ socket whose messages are passed to pickle.loads, an unsafe deserialization flaw (CWE-502). An unauthenticated remote attacker who sends one ZeroMQ message to the transport port can execute code as the user running LMCache, which is root in official container images.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect. The decode path shipped in v0.3.9 and is present through v0.5.5, including the v0.5.6 release candidates. v0.5.6, published on 2026-10-14, removes pickle.loads from this path.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01024 63rd percentileScored 2026-11-07
Fix Fixed LMCache (LMCache): 0.5.6lmcache (PyPI): 0.5.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LMCacheLMCache0.3.9 to before 0.5.60.5.6Patch availableCNA
—lmcache (PyPI)0.3.9 to before 0.5.60.5.6Patch availableGHSA-w5f2-9q9c-ff4h
  • LMCache VendorLMCache Affected 0.3.9 to before 0.5.6 Fixed in 0.5.6 Patch available CNA
  • lmcache (PyPI) Vendor— Affected 0.3.9 to before 0.5.6 Fixed in 0.5.6 Patch available GHSA-w5f2-9q9c-ff4h

Remediation

Upgrade LMCache and the lmcache PyPI package to version 0.5.6, which removes pickle.loads from this decoding path.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA LMCache (LMCache) Fixed in 0.5.6
  • Fix · GHSA-w5f2-9q9c-ff4h lmcache (PyPI) Fixed in 0.5.6 Advisory →

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-105192
  2. 2026-10-07 Alias added: GHSA-vv44-hjm2-qw2f
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-08 EPSS moved to the below the 50th percentile
  5. 2026-10-18 Alias added: GHSA-w5f2-9q9c-ff4h
  6. 2026-10-18 Fix available: PyPI/[email protected] · GHSA-w5f2-9q9c-ff4h
  7. 2026-10-18 CVSS score added · GHSA-w5f2-9q9c-ff4h
  8. 2026-10-18 Weakness changed · GHSA-w5f2-9q9c-ff4h
  9. 2026-10-18 13 new references · GHSA-w5f2-9q9c-ff4h
  10. 2026-10-25 EPSS moved to the 50th–90th percentile
  11. 2026-10-29 Fix available: [email protected] · CNA
  12. 2026-10-29 7 new references · CNA

References

Patch 2

Advisory 4

Other 11

  • TI-2026-69186 LMCache Unauthenticated RCE via /run_script Endpoint CVSS 4.0CRITICAL 9.3
  • TI-2026-69188 Missing authentication in LMCache HTTP server exposes management API CVSS 4.0HIGH 8.8
  • TI-2026-69189 SSRF allowlist bypass in LMCache frontend lacks authentication CVSS 4.0MEDIUM 6.9
  • TI-2026-69187 Missing authentication in LMCache MP Coordinator fleet control API CVSS 4.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences