LMCache multiprocess mode exposes unauthenticated ZeroMQ socket to code execution via pickle (CVE-2026-105192)

Vulnerability Mechanism

LMCache multiprocess (distributed) mode opens a ZeroMQ ROUTER socket without authentication, CURVE encryption, or message HMAC. A specific msgpack extension type is decoded using pickle while the server reads request arguments, occurring before the handler validates the message type. This allows a single crafted message to execute arbitrary code as the LMCache process user.

Impact and Affected Versions

• Affected Versions: 0.3.9 through 0.5.5, 0.5.6 release candidates, and the dev branch.
• Privilege Escalation: JFrog Security Research notes that official container images run as root, amplifying the impact of code execution.
• Exposure: The socket is localhost-only by default but becomes exposed if the bind address is routable. The Hacker News reports that the example Kubernetes DaemonSet in the v0.5.5 tree listens on every interface.

Remediation and Status

• Current Status: No fixed release was available as of the advisory date (October 7, 2026).
• Interim Advice: Keep the port on localhost or restrict it to a trusted cluster network.
• Long-term Fix: Authenticate the transport layer and remove pickle usage.