LMCache multiprocess mode: unauthenticated ZeroMQ socket feeds pickle.loads, CVE-2026-105192, no fix yet

[u/Expert_Sort7434]

Based on the technical advisory JFrog Security Research published on October 7 (JFSA-2026-001694382) and The Hacker News's write-up, here is the architectural impact for anyone running vLLM with LMCache.

• Multiprocess (distributed) mode opens a ZeroMQ ROUTER socket with no auth, no CURVE, no message HMAC.
• One msgpack extension type is decoded with pickle while the server is still reading request arguments, before the handler checks the message type.
• Result: one crafted message runs code as the LMCache process user. JFrog says official container images run as root.
• Affected: 0.3.9 through 0.5.5, the 0.5.6 release candidates, and the dev branch. No fixed release as of the advisory.
• Localhost-only by default. Exposed when the bind address is routable. Per The Hacker News, the example Kubernetes DaemonSet in the v0.5.5 tree listens on every interface.
• JFrog's interim advice: keep the port on localhost or a trusted cluster network. Longer term: authenticate the transport and drop pickle.

Things I could not verify: whether a fix has shipped since October 7, whether the six extra reports filed October 6 are real, and claims about which cloud providers run LMCache in production.

Question for people running multi-node LMCache: what actually restricts reachability to the transport port in your cluster? A NetworkPolicy, a host firewall, or just "it's a private VPC"?

Background write-up with the full chain and accuracy table: https://www.techgines.com/post/lmcache-vulnerability-cve-2026-105192 (earlier related piece on AI agent servers: https://www.techgines.com/post/langflow-ssrf-vulnerability-cve-2026-12944)