Am I affected by LMCache multiprocess mode runs attacker code through an unauthenticated port? What should I do?

Question

LMCache's multiprocess mode, also called distributed mode, opens a ZeroMQ transport on port 5555 that asks for no password or other authentication.

Affected: lmcache 0.3.9 through 0.5.5, the 0.5.6 release candidates, and dev branch builds before PR #5644. Fixed in: 0.5.6. What should you check, and what should you do about it?

Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/cve-2026-105192-lmcache

AgentArmorHQ team · Accepted Answer

**Am I affected?**
Affected: lmcache 0.3.9 through 0.5.5, the 0.5.6 release candidates, and dev branch builds before PR #5644. Fixed in: 0.5.6.
- Check your version: run `pip show lmcache`. Versions >= 0.3.9, < 0.5.6 of lmcache are affected.

**What to do now**
1. Upgrade to the fixed version: run `pip install --upgrade "lmcache>=0.5.6"` (first patched version 0.5.6).
2. Do not bind the transport to a routable address; keep it on localhost or a trusted cluster network.
3. Restrict access to the transport port (5555 by default) with firewall rules or network policies.
4. If the transport port was ever reachable from an untrusted network, rotate reachable credentials and redeploy from clean images.

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

**Sources**
- GitHub Advisory Database: https://github.com/advisories/GHSA-w5f2-9q9c-ff4h

Full incident page: https://agentarmorhq.com/incidents/2026/10/cve-2026-105192-lmcache

Am I affected by LMCache multiprocess mode runs attacker code through an unauthenticated port? What should I do?

1 answer

Add your answer or comment