JFrog Flags Unpatched CVSS 9.8 RCE in LMCache vLLM Layer
TL;DR
- JFrog shipped a working PoC on disclosure day covering LMCache 0.3.9 through 0.5.5 including all 0.5.6 release candidates, with no fixed version available.
- Default port 5555 binds to localhost, but operators routinely expose it via the --host flag for multi-node vLLM scaling, directly enabling unauthenticated network RCE.
- Official LMCache container images run as root, so successful exploitation yields full host-level privileges rather than container-only access.
LMCache, the open-source KV-cache layer most commonly bolted onto vLLM inference servers, has an unauthenticated remote-code-execution flaw with a CVSS score of 9.8 and no fix as of October 7, The Hacker News reported. JFrog Security Research tracks it as CVE-2026-105192; versions from 0.3.9 onward, including the current 0.5.5 release and the 0.5.6rc3 candidate, remain vulnerable.
The bug lives in LMCache's multiprocess mode, which opens a ZeroMQ ROUTER socket on port 5555 by default. JFrog's advisory, credited to researcher Yuval Moravchick, notes the socket "lacks CURVE encryption, ZAP authentication, or message verification." Messages arrive as msgpack, and extension code 1 is wired to `DeviceIPCWrapper.Deserialize`, which calls `pickle.loads` on attacker-controlled bytes before any handler runs. One DEALER message executes arbitrary code as the LMCache process user, and "official container images run this process as root."
The blast radius depends on where the socket is bound. Default localhost binding limits exposure to a single node, but Moravchick flags that operators routinely set a routable address via the `--host` parameter when scaling vLLM across machines, which is the deployment shape that turns this into unauthenticated network RCE.
JFrog's interim guidance is to replace pickle with a safe serializer for extension code 1, add CURVE or HMAC-based auth on the transport, and firewall port 5555 off the network until a patched build ships. For scale context, our tracker has logged 445 AI infrastructure items in the last 90 days on the infrastructure beat, and LMCache sits squarely in the hot layer of that stack between vLLM and the GPU.
What others are reporting
-
JFrog Security Research Read →
Original disclosure with full technical breakdown: msgpack extension code 1 triggers pickle.loads during REGISTER_KV_CACHE argument decode, before handler logic runs, with working PoC.
A single unauthenticated ZMQ DEALER message to the transport port therefore executes code as the user the LMCache process runs as.
-
GBHackers Read →
Pins affected range at 0.3.9-0.5.5 including 0.5.6rc3; specifies container images run as root, clarifying the result is host-level takeover rather than a container escape.
Incoming messages use MessagePack, with extension code 1 associated with DeviceIPCWrapper.
-
Forkast News Read →
Contextualizes the flaw as part of a trust-through-defaults failure pattern in infrastructure software; adds that compromising the cache layer can corrupt agent cache systems at scale.
A single, unauthenticated ZeroMQ DEALER message to port 5555 executes arbitrary code with the privileges of the LMCache process.
-
Rankiteo Read →
Frames single-host vs multi-node deployment as the decisive exposure split; explicitly states firewalls alone are insufficient and no vendor patch exists.
Attackers can send a crafted ZeroMQ DEALER message to TCP port 5555, triggering pickle.loads on untrusted input
Originally reported by thehackernews.com
Read the original article →Original headline: Unpatched LMCache CVSS 9.8 RCE Flaw Hits vLLM Inference Stacks via Pickle Deserialization