Unauthenticated RCE in LMCache's Multiprocess ZMQ Transport via Pickle Deserialization

What happened

A GitHub security advisory (GHSA-w5f2-9q9c-ff4h, CVE-2026-105192) discloses an unauthenticated remote code execution flaw in LMCache, a KV-cache sharing library used with vLLM. In LMCache's multiprocess (distributed) mode, worker processes communicate over a ZeroMQ ROUTER socket (default port 5555) with no authentication — no CURVE, ZAP, or password protection. According to the advisory, a DeviceIPCWrapper message type on that socket is decoded via pickle.loads before the intended handler even runs. A single crafted ZMQ DEALER message can therefore trigger arbitrary code execution as the user running the LMCache process. The advisory includes a working proof of concept and notes official container images ran as root.

The transport binds to localhost by default and is not exposed in single-process (in-vLLM) mode, so exposure depends on configuration: deployments that set --host to a routable address for multi-node setups — including the project's own example Kubernetes manifest, which reportedly bound all interfaces — are affected. The flaw has reportedly been present since v0.3.9, remains in the latest PyPI release (v0.5.5) and 0.5.6 release candidates, and was fixed in 0.5.6.

Why it matters

LMCache is used in LLM-serving stacks to share key-value cache across vLLM workers, often in multi-node GPU clusters. A CVSS 9.8 unauthenticated RCE in that path means any host that can reach the transport port could, per the PoC, gain code execution as root inside an inference node — a serious foothold in environments that may also hold model weights, API keys, or access to other cluster services. Multi-node and Kubernetes-based LLM deployments that followed the documented distributed-mode setup are the ones at risk; isolated single-host, single-process installs are not reachable through this path.

What defenders should watch for

• Inventory any LMCache multiprocess/distributed deployments and check whether the transport port (default 5555) is bound to a routable or cluster-wide address rather than localhost.
• Firewall or network-policy the transport port so only trusted sibling LMCache processes can reach it, pending upgrade.
• Upgrade to LMCache 0.5.6, which replaces pickle with validated, typed MessagePack descriptors and an allowlist for device wrapper types — note the wire format changed, so all workers and servers must be upgraded together.
• Rebuild from the updated Dockerfile so LMCache runs as a non-root user rather than root, per the official image fix.
• If the port was ever reachable from an untrusted network, treat the host as potentially compromised: review connections to it, look for unexpected child processes or outbound activity from the LMCache process, rotate any credentials reachable from that host, and redeploy from clean images.

Developing intel

This is fresh, net-new advisory intel published 2026-10-16 with a public PoC and no prior widespread reporting; details may evolve as the ecosystem responds. See the original GitHub Security Advisory for full technical detail: GHSA-w5f2-9q9c-ff4h.