The report
JFrog disclosed CVE-2026-105192 on October 7, identifying an unauthenticated code-execution path in LMCache's multiprocess mode. The vulnerable interface is a ZeroMQ ROUTER socket used to coordinate cached model state across processes, not an LLM prompt or a public chat endpoint. A message from a peer that can reach this listener may trigger Python pickle.loads before the intended cache-registration handler validates the request.
The LMCache research dossier traces the failure to MessagePack extension type 1. During argument decoding, DeviceIPCWrapper.Deserialize invokes pickle.loads on untrusted data. JFrog's laboratory reproduction executes a command as the LMCache process user, then reaches a type error after the command has already run. Parsing an invalid application message therefore does not prevent the effect; execution occurs earlier.
Which deployments can be reached?
| Configuration | What the disclosure establishes |
|---|---|
| LMCache inside a single vLLM process, without multiprocess ROUTER | This separate ZeroMQ listener need not be opened |
| Multiprocess service with default localhost bind | A remote machine does not reach the listener by default |
| Distributed or multi-node service with a routable bind | Any host permitted to connect can submit the unauthenticated encoded frame |
JFrog scores the routable scenario CVSS 9.8 and notes that its reproduction executed under root in the official container image. That does not make every LMCache installation remotely vulnerable. Exposure depends on the configured listener, intervening network policy and the process privileges granted to the service.
The researcher observed the decode path in versions from 0.3.9 through 0.5.5 and in 0.5.6 release candidates through rc3. The October 7 advisory reported no fixed release at that time; a later fix must be verified separately before naming a safe version. Until then, the immediate boundary is to keep the ZeroMQ port non-routable to untrusted hosts and limit who can connect. Authentication and removal of unsafe deserialization are the durable corrections. JFrog did not report a confirmed production exploitation campaign.