JFrog advisory JFSA-2026-001694382 on LMCache multiprocess pickle RCE

Evidence record

Read the original source ↗

Claim-level citations (3)

• supportsLMCache distributed ZeroMQ transport deserializes unauthenticated pickle payloads: LMCache multiprocess mode opens an unauthenticated ZeroMQ ROUTER socket; the default localhost binding is not remotely reachable unless an operator makes it routable.

  Description, ZeroMQ ROUTER authentication and host binding

• supportsLMCache distributed ZeroMQ transport deserializes unauthenticated pickle payloads: MessagePack extension type 1 is dispatched through DeviceIPCWrapper.Deserialize and pickle.loads before REGISTER_KV_CACHE message handling or any handler-level validation.

  Description, DeviceIPCWrapper.Deserialize, ext_hook and REGISTER_KV_CACHE

• supportsLMCache distributed ZeroMQ transport deserializes unauthenticated pickle payloads: JFrog lists affected versions at 0.3.9 and later; the disclosed CVSS 9.8 scenario concerns routable distributed-mode deployments, not every single-host vLLM configuration.

  Affected versions; Description, score and deployment caveat