A critical flaw in LMCache, the open-source key-value cache layer used to speed up vLLM large-language-model servers, let a single unauthenticated network message run code on the cache server. Tracked as CVE-2026-105192 and scored 9.8, it affects LMCache from version 0.3.9 through 0.5.5, and was present in the 0.5.6 release candidates. JFrog Security Research disclosed it on 7 October, when no fixed version had been published; The Hacker News reports the flaw was fixed in version 0.5.6, released on 15 October.

Unsafe deserialization on an open socket

In multiprocess mode, LMCache opens a ZeroMQ socket with no authentication, no encryption and no message verification, so worker processes can register and share cached data. One message type is decoded with Python's pickle, which can carry executable code, and the server unpacks it while still reading the message's arguments, before any handler runs. A single crafted message therefore executes code as the user running the cache process, and official container images run that process as root.

Exposure depends on one setting

By default the server binds to localhost and cannot be reached from another machine, but operators routinely set a routable address with the --host flag to scale vLLM across nodes, and the project's own example Kubernetes deployment runs with hostNetwork, listening on every interface. Operators should update to 0.5.6, and until then firewall port 5555 off the network, keep the transport on the loopback interface or a trusted cluster network, and treat any host that can open a connection as a host that can run code.