A critical flaw in LMCache, an open-source component used to speed up large language model servers such as vLLM, lets an unauthenticated attacker run arbitrary code on the machine hosting its cache server, The Hacker News reported Wednesday. JFrog, which found the bug, says no patched version exists.

What Happened

The vulnerability, tracked as CVE-2026-105192, carries a CVSS score of 9.8 when the server is reachable on a routable address. It affects LMCache's multiprocess mode, in which the cache runs as a standalone server and LLM worker processes talk to it over the ZeroMQ messaging library.

According to JFrog's analysis, one type of message arriving on that socket is decoded with Python's pickle format, which can execute code as part of decoding. The decoding happens before the server checks what kind of message it has received and without any authentication, so a crafted message is enough to run commands with the privileges of the LMCache process. In the project's official container images, that process typically runs as root.

RelatedNew curl Release Fixes 24 Flaws, Including a High-Severity Bug Reported With Anthropic’s Claude

JFrog researcher Yuval Moravchick discovered the flaw, and JFrog disclosed it Oct. 7. Affected versions run from 0.3.9, released in October 2025, through 0.5.5, the latest stable release, along with the 0.5.6 release candidates and the development branch. LMCache has not shipped a fix or published a security advisory.

By default, the multiprocess server listens only on the local machine, which keeps it out of reach from the network. But the example Kubernetes deployment in LMCache's own repository starts the server listening on all network interfaces, and deployments copied from it would be exposed to anything that can reach the pod.

The Hacker News also noted that a separate GitHub user reported six other security issues in LMCache on Oct. 6, including unauthenticated access to cached data across tenants. Those reports have no CVE identifiers and have not been confirmed by the maintainers.

Why It Matters

LMCache manages the key-value cache that LLM servers build while processing prompts, storing and sharing it so repeated or overlapping requests do not have to be recomputed. That places it inside inference clusters, next to GPUs, model weights and the prompts and responses flowing through them. Code execution as root on such a host could give an attacker access to user data in transit, proprietary models and the cluster's credentials.

Internal-only exposure is not a strong defense in that setting. Inference clusters are often shared across teams or tenants, and an attacker who compromises any workload on the same network can reach a cache server bound to all interfaces.

Context

Unsafe deserialization with pickle is a recurring class of bug in Python machine learning software, because the format is convenient for passing Python objects between processes but trusts its input completely. Similar flaws have been found in several AI serving and training tools, and the usual fix is to replace pickle with a data-only format or to authenticate peers before decoding anything.

What to Watch

Operators running LMCache in multiprocess mode should check whether the server is bound to anything other than localhost and restrict its port with network policies or firewalls, which JFrog says reduces but does not eliminate the risk. The next steps to watch are a fixed release and advisory from the LMCache maintainers and whether vLLM-based platforms that bundle LMCache issue their own guidance.