Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely
Critical LMCache vulnerability allows unauthenticated remote code execution.
A critical vulnerability (CVE-2026-105192) in LMCache, an open-source LLM caching tool, allows unauthenticated attackers to execute arbitrary code on the server. The flaw, present in versions 0.3.9 through 0.5.6, stems from the use of Python's pickle module for deserializing data from an unauthenticated ZeroMQ socket. While the default configuration limits exposure, misconfigurations or specific deployment examples can expose the vulnerability, potentially allowing code execution with root privileges.
AI summary of the linked source. Not reviewed by an editor. How this works
Run JFrog?
Get an email when a new story names JFrog, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical vulnerability in LMCache (CVE-2026-105192) exposes servers to unauthenticated remote code execution due to the unsafe use of Python's pickle deserialization module over an unauthenticated ZeroMQ socket. Pickle deserialization is a well-known dangerous pattern that can execute arbitrary code during the unpickling process, and exposing it without authentication is a fundamental design flaw. Compounding the risk, certain deployment examples and misconfigurations can expose the vulnerable socket beyond the default local scope, potentially granting attackers root-level access. This case highlights the danger of insecure defaults in open-source AI/ML tooling, a rapidly expanding attack surface that is often under-scrutinized in security reviews.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-105192
- cve — CVE-2026-105756