LMCache is part of the serving path for cached model state, but the vulnerable surface is a transport between worker processes rather than prompt text presented to a model. A network peer able to send a crafted MessagePack object to the unauthenticated distributed ROUTER can reach a pickle decoder before the server validates the intended registration…
Inspect the ClaimsCase · DiggingBeagle record
LMCache distributed ZeroMQ transport deserializes unauthenticated pickle payloads
JFrog describes CVE-2026-105192 in LMCache distributed mode: unauthenticated ZeroMQ messages reach pickle.loads during MessagePack extension decoding; remote reachability depends on an exposed transport binding.
Scope
Reported finding as of 2026-10-13; publication and observation dates are distinguished in the linked source. No production exploitation is inferred without explicit evidence.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- none known
- AI role
- AGAINST AI
Basis and provenance
Evidence desk assessment of the pinned Claims and source provenance, checked against the public primary report or advisory. JFrog provides an inspectable reproduction of an unauthenticated deserialization path in routably bound LMCache multiprocess mode. At disclosure no fixed release was identified; this does not prove exploitation in any real customer installation. Impact remains unbanded because verified real-world affected scope and realized harm are not established. Findings are not independent reproduction by DiggingBeagle.
Assessed Oct 14, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP5-LMCACHE-ZMQ-1 · CLM-CP5-LMCACHE-ZMQ-2 · CLM-CP5-LMCACHE-ZMQ-3 · JFrog advisory JFSA-2026-001694382 on LMCache multiprocess pickle RCE
At a glance
The dangerous boundary is before the application handles the purported cache registration: MessagePack extension decoding already enters Python pickle deserialization. Listener reachability is a decisive precondition. A default loopback bind is not remotely reachable, while a multi-node ROUTER address may be; treating those setups as equally exposed would…
Read the implicationsCurrent fixed release and backport status require a confirmed maintainer changelog. No exploitation campaign or exposed deployment inventory was independently established.
Limits and uncertaintyFull account
LMCache is part of the serving path for cached model state, but the vulnerable surface is a transport between worker processes rather than prompt text presented to a model. A network peer able to send a crafted MessagePack object to the unauthenticated distributed ROUTER can reach a pickle decoder before the server validates the intended registration command. That decoder may execute code under the LMCache process privileges.
Exposure depends on configuration. A default single-host deployment binds this socket to localhost, and LMCache embedded only inside vLLM need not open it. Routing the transport across nodes enlarges the reachable trust boundary; the 9.8 severity statement presumes that exposure. The advisory does not establish an in-the-wild compromise, nor does it verify a complete affected-version patch matrix.
Claims & evidence
CLM-CP5-LMCACHE-ZMQ-1LMCache multiprocess mode opens an unauthenticated ZeroMQ ROUTER socket; the default localhost binding is not remotely reachable unless an operator makes it routable.supported
Basis: reported finding
- supportsJFrog advisory JFSA-2026-001694382 on LMCache multiprocess pickle RCEprimary disclosure
Description, ZeroMQ ROUTER authentication and host binding
CLM-CP5-LMCACHE-ZMQ-2MessagePack extension type 1 is dispatched through DeviceIPCWrapper.Deserialize and pickle.loads before REGISTER_KV_CACHE message handling or any handler-level validation.supported
Basis: reported finding
- supportsJFrog advisory JFSA-2026-001694382 on LMCache multiprocess pickle RCEprimary disclosure
Description, DeviceIPCWrapper.Deserialize, ext_hook and REGISTER_KV_CACHE
CLM-CP5-LMCACHE-ZMQ-3JFrog lists affected versions at 0.3.9 and later; the disclosed CVSS 9.8 scenario concerns routable distributed-mode deployments, not every single-host vLLM configuration.supported
Basis: reported finding
- supportsJFrog advisory JFSA-2026-001694382 on LMCache multiprocess pickle RCEprimary disclosure
Affected versions; Description, score and deployment caveat
Implications
The dangerous boundary is before the application handles the purported cache registration: MessagePack extension decoding already enters Python pickle deserialization. Listener reachability is a decisive precondition. A default loopback bind is not remotely reachable, while a multi-node ROUTER address may be; treating those setups as equally exposed would distort the severity assessment.
Controls and mitigations
- Do not expose the unauthenticated multiprocess ROUTER port to untrusted networks. Keep it on loopback when multi-node access is unnecessary and restrict peer connectivity when distributed operation is required.
- Avoid unsafe pickle deserialization in pre-authentication parsing; isolate service process privileges so a parser compromise cannot automatically inherit sensitive host or container authority.
Unknowns and contradictions
- Current fixed release and backport status require a confirmed maintainer changelog.
- No exploitation campaign or exposed deployment inventory was independently established.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 144