LMCache, the distributed key-value cache layer for the vLLM inference engine, exposes an unauthenticated remote code execution (RCE) path via CVE-2026-105192. With a CVSS score of 9.8, this flaw affects versions 0.3.9 through 0.5.5. As of October 7, 2026, the vulnerability remains unpatched. The flaw stems from insecure deserialization within the infrastructure designed to accelerate LLM inference, a component increasingly central to the economic viability of agent-based workloads.
The technical mechanism centers on the LMCache distributed mode, which opens an unauthenticated ZeroMQ ROUTER socket on port 5555 by default. While the transport is intended for worker registration and KV cache block sharing, it lacks authentication. The system processes messages using msgpack; specifically, extension code 1 passed to DeviceIPCWrapper.Deserialize triggers pickle.loads on attacker-controlled data. This execution occurs during request argument decoding, before any handler logic. A single, unauthenticated ZeroMQ DEALER message to port 5555 executes arbitrary code with the privileges of the LMCache process. Because official container images run this as root, the result is total system compromise.
Compromising the inference acceleration layer grants an attacker control over the agent’s underlying cache, effectively poisoning the infrastructure. While the transport binds to localhost by default, operators frequently configure a routable address using the --host flag for multi-node deployments. In these configurations, the service becomes accessible over the network, significantly expanding the attack surface.
LMCache’s architecture exemplifies the trust-through-defaults pattern. The transport port 5555 is open and unauthenticated by design. This mirrors failures in systems like Cisco NX-API, HPE ClearPass, Splunk MCP Server, and DB-GPT. In these environments, the assumption that internal network traffic is inherently trusted leads to the omission of authentication for critical functions (CWE-306).
As of October 7, 2026, no patch exists to remediate the insecure deserialization. The reliance on pickle.loads in a distributed, unauthenticated context creates a persistent risk for any environment where the LMCache port is reachable. While the EPSS score sits at 0.671%, the critical nature of the RCE and the lack of a patch necessitate immediate isolation of the LMCache port.
The integration of LMCache with vLLM suggests that potential exposure is not limited to niche deployments. Organizations using LMCache to optimize inference performance for agent workloads must account for this in their threat models. Until a patch is released, the primary mitigation involves restricting network access to the LMCache port and auditing the deployment environment for any instances where the --host flag has been set to a routable address.