CVE-2026-105192 in LMCache
Summary
by MITRE • 10/07/2026
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability in LMCache's multiprocess or distributed mode stems from an insecure deserialization flaw within its inter-process communication mechanism. When operating in this configuration, the system opens an unauthenticated ZeroMQ ROUTER socket to allow worker processes to register and share key-value cache blocks. This design choice introduces a critical security gap because the messages transmitted over this transport layer are serialized using msgpack, but specific extension codes trigger unsafe processing routines. Specifically, when message extension code 1 is received, it is passed directly to DeviceIPCWrapper.Deserialize, which subsequently invokes Python's pickle.loads function. Because this deserialization occurs while the server is still decoding request arguments and prior to any handler execution or authentication checks, an attacker can exploit this window of opportunity to execute arbitrary code on the host system.
The operational impact of this vulnerability is severe due to the default configuration settings often found in production environments. Official container images for LMCache run the process with root privileges by default. Consequently, a single unauthenticated ZeroMQ DEALER message sent to the transport port, which defaults to 5555, results in remote code execution as the root user. This grants an attacker full control over the underlying system, allowing them to modify configurations, exfiltrate sensitive data from the cache, or pivot further into the network infrastructure. Although the ZeroMQ socket binds to localhost by default, limiting immediate exploitation to local users within the same container or host, operators who configure routable addresses using the --host flag for multi-node deployments expose this endpoint to remote attackers on the network. This significantly expands the attack surface from a local privilege escalation issue to a critical remote code execution vulnerability accessible over TCP/IP.
From a classification perspective, this flaw aligns with CWE-502, which denotes Deserialization of Untrusted Data, as well as CWE-78, Improper Neutralization of Special Elements used in an OS Command if the deserialized payload leads to command injection. In terms of adversary tactics, this vulnerability facilitates initial access and privilege escalation techniques documented in the MITRE ATT&CK framework, specifically relating to remote code execution via insecure deserialization patterns often seen in Python-based applications like pickle abuse. The lack of authentication on a socket intended for internal communication represents a failure in secure design principles where trust boundaries are not properly enforced between components that may operate under different privilege levels or security contexts.
Mitigation strategies must address both the immediate configuration risks and the underlying architectural flaw. Operators should immediately avoid using official container images with root privileges unless absolutely necessary, instead configuring LMCache to run as a non-privileged user with minimal permissions. Furthermore, if distributed mode is required, administrators must ensure that the transport port remains bound strictly to localhost or is protected by strict firewall rules allowing connections only from trusted peer IPs. However, these are temporary workarounds; the fundamental issue lies in the use of pickle for deserializing data received over an unauthenticated channel. The long-term solution requires replacing the unsafe pickle.loads mechanism with a secure serialization format such as JSON or msgpack-only parsing that does not support arbitrary object instantiation. Additionally, implementing authentication mechanisms on the ZeroMQ socket would prevent unauthorized processes from registering and sending malicious payloads, thereby closing the exploitation vector entirely until code-level patches are deployed by the maintainers to enforce strict input validation and safe deserialization practices.