LMCache multiprocess mode runs attacker code through an unauthenticated port
- Product
- LMCache
- CVE
- CVE-2026-105192
- Affected
- lmcache 0.3.9 through 0.5.5, the 0.5.6 release candidates, and dev branch builds before PR #5644
- Fixed in
- 0.5.6
Last verified against sources: October 26, 2026
Am I affected?
LMCache: affected lmcache 0.3.9 through 0.5.5, the 0.5.6 release candidates, and dev branch builds before PR #5644. Fixed in 0.5.6.
- Check your version: run
pip show lmcache. Versions >= 0.3.9, < 0.5.6 of lmcache are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "lmcache>=0.5.6"(first patched version 0.5.6). [1] - Do not bind the transport to a routable address; keep it on localhost or a trusted cluster network. [1]
- Restrict access to the transport port (5555 by default) with firewall rules or network policies. [1]
- If the transport port was ever reachable from an untrusted network, rotate reachable credentials and redeploy from clean images. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- LMCache's multiprocess mode, also called distributed mode, opens a ZeroMQ transport on port 5555 that asks for no password or other authentication. [1]
- Device IPC descriptors received on that transport were turned back into objects with pickle.loads, which can run code. [1]
- A single crafted message to the transport port runs code as the user the LMCache process runs as. [1]
- The unsafe decode path shipped in v0.3.9 and is still present in v0.5.5 and in the v0.5.6 release candidates through v0.5.6rc3. [1]
Impact
- An attacker who can reach the transport port can run any code with the privileges of the LMCache process. [1]
- By default the transport binds to localhost, so a stock single-host install is not reachable from other machines. [1]
- Deployments are exposed when the transport binds a routable address, which is how multi-node setups let peers connect. [1]
- Official container images ran the LMCache process as root. [1]
What was done
- The issue is fixed in 0.5.6, where pickle was replaced with versioned, typed MessagePack descriptors that are checked before use. [1]
- The wire format changed, so all workers and servers must be upgraded together. [1]
- 0.5.6 also binds the example Kubernetes deployment to localhost (PR #5684) and runs official images as a non-root user (PR #5685). [1]
Sources
- GHSA-w5f2-9q9c-ff4h — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-105192] LMCache multiprocess mode runs attacker code through an unauthenticated port
Product: LMCache | Affected: lmcache 0.3.9 through 0.5.5, the 0.5.6 release candidates, and dev branch builds before PR #5644 | Fixed in: 0.5.6
Summary: LMCache's multiprocess mode, also called distributed mode, opens a ZeroMQ transport on port 5555 that asks for no password or other authentication.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/cve-2026-105192-lmcacheCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-105192
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.