CVE-2026-105192: LMCache Remote Code Execution via Unsafe Deserialization in Multiprocess Mode Transport
Summary
CVE-2026-105192: LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport. Affects lmcache versions >= 0.3.9, < 0.5.6. Fixed in 0.5.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LMCache is an open-source caching library designed for high-performance key-value storage and retrieval in Python applications. It supports multiprocess mode, allowing multiple instances to share cache data over a network using ZeroMQ for communication. However, this mode introduces significant security risks due to its lack of authentication and reliance on unsafe deserialization methods.
Vulnerability Detail
LMCache is vulnerable to unauthenticated remote code execution due to unsafe deserialization of messages sent over its ZeroMQ transport in multiprocess mode. The vulnerability arises when the library processes messages that include pickled data without proper validation. An attacker can exploit this by sending a specially crafted message to the transport port, executing arbitrary code with the privileges of the LMCache process, which often runs as root. This vulnerability is critical, with a CVSS score of 9.8, as it allows complete control over the affected system.
How To Fix
Latest published version: 0.5.6 as of 22 Oct 2026
pip install --upgrade "lmcache==0.5.6"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Until you can upgrade, consider the following workarounds: 1. Do not bind the transport to a routable address; keep it on localhost or a trusted network. 2. Restrict access to the transport port (default 5555) using firewall rules or network policies. 3. Run LMCache as a non-root user by building from the provided Dockerfile.
Conclusion
CVE-2026-105192 represents a critical security vulnerability in LMCache that allows remote code execution through unsafe deserialization. It is essential to update to version 0.5.6 or later to mitigate this risk. Implementing the recommended workarounds can provide temporary relief until an upgrade is feasible.
See every vulnerability recorded for lmcache →
FAQ
LMCache is a high-performance key-value caching library for Python applications, designed to facilitate fast data retrieval and storage.
CVE-2026-105192 allows remote code execution through unsafe deserialization in LMCache's multiprocess mode, potentially compromising the entire system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could allow attackers to execute arbitrary code on your server, leading to data breaches, system compromise, and loss of control over your application.
If your system was exposed, review connections to the transport port, check for unexpected processes, rotate credentials, and redeploy from clean images.
References
Related vulnerabilities
Recent vulnerabilities recorded for lmcache.
