CVE-2026-105192: LMCache unauthenticated pickle deserialization in multiprocess mode

CVE-2026-105192 lets an unauthenticated peer reaching LMCache multiprocess transport trigger unsafe pickle deserialization. Check whether the ZMQ endpoint is routable, contain access, and monitor for a vendor fix.^{[1], [2]}

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H^[2]

💡 Plain English Explainer (ELI5)

LMCache accepts a sealed package from a network peer, then opens it with a mechanism that can execute instructions hidden inside. The safety boundary failed before the server checked what kind of message the package claimed to be.^{[1], [2]}

Core Concepts & Subsystem Terms

CWE-502: unsafe deserialization: Python pickle can execute behavior while reconstructing objects. It is unsafe for data supplied by an untrusted network peer.^{[1], [2]}
LMCache multiprocess mode: A mode where LMCache components communicate through a ZeroMQ transport. The CVE record describes an unauthenticated ROUTER endpoint.^{[2], [5]}
MessagePack extension: A MessagePack extension value is handed to DeviceIPCWrapper.Deserialize during decoding; this happens before request-type dispatch.^{[2], [4], [3]}
Exposure boundary: The transport binds locally by default according to the CVE record. A routable --host or reachable cluster network changes who can send it messages.^{[2], [5]}
Affected releases: The disclosure reports versions 0.3.9 through 0.5.5, including 0.5.6 release candidates and the development branch, as of 2026-10-07.^{[1], [2]}
CWE-306: Missing Authentication for Critical Function: The CVE record also assigns CWE-306 because the ZeroMQ ROUTER has no peer authentication. This is a separate transport-boundary weakness from CWE-502, the unsafe pickle reconstruction. Exposure still depends on a reachable endpoint; the default localhost bind is not remotely reachable by itself.^[2]

Framework mappings

CWE reference for the weakness described in this guide: CWE-306 CWE-502

Step-by-Step Attack Flow

Step 1

A deployment enables multiprocess transport

The issue concerns LMCache multiprocess/distributed mode, not every LMCache installation.^{[2], [1]}

Step 2

A peer can reach the ZMQ endpoint

The CVE record says the transport defaults to localhost; an operator may set a routable --host. Reachability is a prerequisite.^{[2], [5]}

Step 3

Decoding invokes pickle.loads

MessagePack extension code 1 reaches DeviceIPCWrapper.Deserialize, which calls pickle.loads before the request handler validates the message type.^{[2], [4], [3]}

Step 4

The process handles the reconstructed object

The record says code executes with the LMCache process privileges; the official container runs as root. This describes impact, not proof that a particular deployment is exposed.^{[2], [3]}

Deployment condition and response

Condition	Assessment
Multiprocess mode disabled	This CVE path is not enabled.
Multiprocess mode; loopback-only bind	Remote network peers are not expected to reach the endpoint; verify host networking and local trust boundaries.
Routable bind or exposed cluster port	Treat as potentially reachable; restrict access immediately and assess process privileges.
Affected releases	The disclosure reports versions 0.3.9 through 0.5.5, including 0.5.6 release candidates and the development branch, as of 2026-10-07.

Source Code: Flaw vs. Secure Implementation

The CVE Program record attributes CVE-2026-105192 to JFrog and documents the MessagePack extension → DeviceIPCWrapper.Deserialize → pickle.loads path, the default localhost bind, the optional routable --host, and CVSS 9.8. Upstream source confirms the deserializer call. This article does not provide a weaponized pickle or claim a vendor patch. A reachable endpoint is required; default local binding alone does not make a deployment remotely reachable. The temporary code example is a fail-closed application guard that disables this decoding path, not a drop-in LMCache patch; coordinate service impact and use network isolation while awaiting a supported fix.^{[2], [1], [3], [4], [5]}

UNPATCHED FLAW

@staticmethod
def Deserialize(data: bytes) -> DeviceIPCWrapper:
    return pickle.loads(data)

HARDENED SECURE PATCH

@staticmethod
def Deserialize(data: bytes) -> DeviceIPCWrapper:
    # Temporary fail-closed containment, not an upstream patch.
    raise PermissionError("LMCache peer deserialization disabled pending vendor fix")

Engineering & System Hardening Checklist

✓Inventory LMCache deployments and identify those using multiprocess or distributed mode; record package and container versions.^{[1], [2]}
✓Check the actual ZMQ bind address and network routes. Do not assume a private cluster is safe if untrusted workloads or tenants can reach the endpoint.^{[2], [5]}
✓Until a vendor fix is available, disable multiprocess transport where feasible or bind it only to loopback when single-host operation is sufficient. For required multi-node use, restrict the port to explicitly trusted peers with network policy/firewall rules; this reduces reachability but does not make pickle safe. For any future routable deployment, require authenticated ZMQ peers (for example, CURVE or per-message HMAC) and replace pickle with a validated data-only wire format; firewall allowlisting alone is not authentication.
✓Run the service as a dedicated unprivileged user and remove unnecessary container capabilities; the CVE record says the official container runs as root, increasing impact.^[2]
✓Monitor upstream LMCache security advisories and package releases. Upgrade only to a release that explicitly fixes CVE-2026-105192; no fixed release was identified in the disclosure material reviewed for this article.^{[1], [2]}
✓Review network logs for unexpected connections to the multiprocess transport port (default 5555 per the CVE record); investigate exposure before assuming compromise.^{[2], [5]}

Sources

← AI Security Hub Directory →