TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1101-13Unpatched, public PoC
LMCache RCE (CVE-2026-105192): unauthenticated code execution in the vLLM cache layer
LMCache, the distributed key-value cache that accelerates vLLM inference, opens an unauthenticated ZeroMQ socket on port 5555 and feeds it to pickle. One message runs code as the LMCache process, which official containers run as root. There is no patch. A public proof-of-concept shipped with the advisory. Firewall the port, bind to localhost, and prove nothing routable can reach it.
SEVERITY
Critical
PEAK CVSS
9.8
AUTH REQUIRED
None
PUBLIC POC
Yes
PUBLISHED
Nov 1, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
The fastest-growing attack surface in your estate is the one your AI team stood up last quarter, and it does not look like a server to anyone watching the perimeter.
LMCache is the cache that makes vLLM fast enough for agent workloads. To share cached data between workers it opens a ZeroMQ socket on port 5555, and that socket hands whatever arrives straight to Python's pickle. Pickle will run code while it loads data. So a single unauthenticated message to port 5555 executes commands as the LMCache process, which the official container images run as root. That is full host compromise from one packet, no login, no exploit chain.
There is no patched version. JFrog published the finding with a working proof-of-concept on the same day, which means the window between disclosure and opportunistic scanning is already closed. This is the same mistake, untrusted bytes handed to pickle, that researchers found across a cluster of AI inference frameworks they named ShadowMQ. The lesson for a CISO is blunt: the AI inference layer is production infrastructure now, and it has to be inventoried, segmented and validated like any other internet-adjacent service.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking an unpatched, unauthenticated remote code execution flaw in LMCache, the distributed KV cache for the vLLM inference engine. In distributed mode it exposes a ZeroMQ socket on port 5555 that deserializes untrusted input with pickle, so one message runs code as the LMCache process, which official images run as root. JFrog disclosed it with a working PoC on Oct 7 and no fix exists. The control today is network isolation of the transport port, verified.
KEY JUDGMENTS
01
JFrog Security Research published CVE-2026-105192 with a full working proof-of-concept on Oct 7, 2026. No fixed version exists as of this advisory.Observed
02
Only distributed deployments with a routable bind are remotely exploitable. A single-process vLLM that embeds LMCache does not open the port. Reachability decides exposure.Assessed
03
Official LMCache container images run the process as root, so a successful message is full host takeover, not a scoped compromise.Reproduced
04
This is the ShadowMQ pattern: untrusted bytes handed to pickle, found across multiple AI inference frameworks. Expect the same class elsewhere in the inference stack.Assessed
CWE-502 deserialization of untrusted data (pickle)
Transport
Unauthenticated ZeroMQ on TCP 5555 by default
Affected
0.3.9 through 0.5.5, plus 0.5.6 release candidates and dev branch
Scoring
9.8 · CVSS v3.1
Patch
None as of Nov 1, 2026
Impact
Arbitrary code execution as the LMCache process, root in official images.
EXPOSURE: DISTRIBUTED MODE ON A ROUTABLE BIND
01Affected versionLMCache 0.3.9 to 0.5.5, or 0.5.6 RCs, or dev.
02Distributed modeThe standalone cache server, not an embedded single-process cache.
03Routable bindStarted with a routable --host, so port 5555 is reachable.
04Runs as rootOfficial container images do, which turns RCE into host takeover.
03 · THREAT ACTIVITY
Exploitation status and timeline
PATCHNoneNo fixed version as of Nov 1.
PUBLIC POCAvailableJFrog shipped a PoC with the advisory.
CISA KEVNot listedNot in KEV yet; treat as imminent.
BLAST RADIUSRootOfficial images run as root.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Oct 6A GitHub user opens six additional LMCache security reports alleging cross-tenant data access and command execution. No CVE, no fix.
Oct 7JFrog discloses CVE-2026-105192 with a working PoC. No patch exists.
ContextThe same pickle-on-an-unauthenticated-socket pattern was found across AI inference frameworks in late 2025, dubbed ShadowMQ.
04 · AFFECTED PRODUCTS
Affected and fixed versions
A version check is not enough on its own. An affected version is only remotely exploitable when it runs in distributed mode with the transport bound to a routable address.
ITEM
AFFECTED
FIXED IN
STATUS
LMCache 0.3.9 to 0.5.5
distributed, routable bind
none yet
No fix
LMCache 0.5.6 release candidates
still affected
none yet
No fix
Development branch
still affected
none yet
No fix
Single-process vLLM (embedded)
port not opened
not exposed
Not exposed
RELATED vLLM DoSA separate vLLM flaw, CVE-2026-105756, let a malformed cache_salt crash the engine on LMCache multiprocess deployments. It is fixed in vLLM 0.30.0 and is a denial of service, not code execution. Patch it in the same pass.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Any routable LMCache transportFirewall TCP 5555 off every untrusted and shared network now. This is the primary control while no patch exists.
Internet-exposed inference hostsConfirm port 5555 is not reachable from outside the cluster. Never expose it publicly.
HighWithin 72 hours
Distributed deploymentsRebind the transport to localhost or a private, authenticated network segment only.
Container deploymentsRun LMCache as a non-root user so a successful message is not an instant host takeover.
Example Kubernetes manifestsReview the project's example deployment, which binds to every interface by default.
HighBefore closing
Every inference hostRecord the LMCache version, the bind address of port 5555, and the process user as evidence.
WORKAROUNDS
Firewall port 5555. Block the ZeroMQ transport on all untrusted interfaces. The only reliable control while no patch exists.Bind to localhost. Audit for any --host set to a routable address and move it back to the loopback or a private segment.Drop root. Run the LMCache process as a non-root user to shrink the blast radius of a successful message.Segment the inference tier. Put the cache transport on a private, authenticated network the rest of the estate cannot reach.
06 · DETECTION AND HUNTING
Observables and hunting queries
JFrog's advisory does not provide a way to tell whether a server was already hit. Hunt on exposure of the transport and on anomalous children of the cache process.
TYPE
OBSERVABLE
SOURCE
Exposure
Port 5555 listening on a routable address
ss -lntp, host and cluster scans
Exposure
An LMCache process running as root
ps, container runtime
Behavior
The LMCache process spawning a shell or network tool
EDR, process telemetry
EXPOSURE · CVE-2026-105192transport bind address
ss -lntp | grep ':5555'
HUNT · CVE-2026-105192unexpected children of the cache
LMCache runs the KV cache as a standalone server in distributed mode, and vLLM workers reach it over ZeroMQ. In that mode it opens a ROUTER socket on TCP 5555 with no authentication. The transport is meant for worker registration and cache-block sharing, but it passes received messages to Python's pickle to deserialize them. Pickle executes code during loading by design, so a single unauthenticated DEALER message to port 5555 runs arbitrary commands as the user that owns the LMCache process.
Official container images run that process as root, which turns code execution into full host compromise. The flaw is only remotely reachable when an operator starts the server with a routable address, which is exactly how multi-node deployments share a cache across machines, and how the project's own example Kubernetes manifest configures it. A copy of LMCache embedded in a single vLLM process does not open the port at all. The root cause, untrusted network bytes handed to pickle, is the same defect class as the ShadowMQ cluster of AI-framework flaws, so treat the whole inference tier as suspect, not just this one component.
01 REACH
Attacker reaches port 5555 on a routable bind
Control: Firewall 5555, bind to localhost
02 SEND
One unauthenticated ZeroMQ message arrives
Control: Private, authenticated network segment
03 UNPICKLE
LMCache deserializes it with pickle
Control: No patch yet: isolation is the control
04 ROOT
Code runs as the cache process, root in official images
ShadowForge: another AI-infrastructure flaw where a trusted-by-default component hands control to a caller.
AssessedThe AI inference layer is production infrastructure, and it ships with trust-by-default transports. Inventory, segment and validate it like any other internet-adjacent service.
09 · VALIDATION
Confirm remediation
A version string is not a verdict while no patch exists. Each inference host should end with evidence: the transport unreachable from untrusted networks, or exposed and isolated now.
01
Inventory LMCache and its mode
Find every LMCache instance and whether it runs distributed or embedded.
pip show lmcache 2>/dev/null | grep -i version
kubectl get pods -A -o json | jq -r '.items[]|select(.spec.containers[].image|test("lmcache";"i"))|.metadata.namespace+"/"+.metadata.name'
02
Check the transport bind
A routable bind on 5555 is remotely exploitable; localhost is not.
ss -lntp | grep ':5555'
03
Check the process user
Root turns a message into host takeover.
ps -o user= -p "$(pgrep -f lmcache | head -1)"
04
Prove network isolation
From an untrusted vantage, confirm port 5555 is not reachable.
# from outside the cluster, in scope: nc -vz <inference-host> 5555 should fail
05
Patch the related vLLM DoS
Move vLLM to 0.30.0 or later for CVE-2026-105756.
pip show vllm 2>/dev/null | grep -i version
10 · EXPOSURE SELF-ASSESSMENT
Am I exposed?
CVE-2026-105192
01Do you run LMCache 0.3.9 to 0.5.5 (or a 0.5.6 RC or dev build) anywhere, including research clusters?
02Does any LMCache run in distributed mode with the transport bound to a routable address?
03Is port 5555 reachable from any untrusted or shared network?
04Does the LMCache process run as root (for example in an official container image)?
ANSWER TO SEE A VERDICT
Pick yes, no or not sure for each question.
11 · REFERENCES AND REVISION HISTORY
References
›JFrog Security Research advisory and PoC for CVE-2026-105192
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is CVE-2026-105192 patched?
No. As of Nov 1, 2026 there is no fixed version. The control is network isolation of port 5555 and running as non-root.
Is it being exploited?
JFrog published a working proof-of-concept with the advisory, which makes exploitation trivial for any exposed instance. It was not in CISA's KEV catalog as of Nov 1.
Am I affected if I embed LMCache in a single vLLM process?
No. The flaw is in distributed mode, which opens the transport. An embedded single-process cache does not open port 5555.
Why is this root-level?
Official LMCache container images run the process as root, so code execution via the socket is a full host takeover. Running as a non-root user shrinks the blast radius.
VALIDATE YOUR EXPOSURE
Prove your AI inference exposure
Hayrok inventories your inference tier, finds LMCache transports bound to routable addresses, and tests whether port 5555 is reachable from untrusted networks. Every result lands in Evidence Fabric.