What is the CVSS score of CVE-2026-105192?

CVE-2026-105192 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of LMCache are affected by CVE-2026-105192?

LMCache's multiprocess (distributed) mode contains a critical remote code execution flaw that, when network-exposed, could allow an attacker to run arbitrary code as the LMCache process user-root in…

How to fix or mitigate CVE-2026-105192?

Within 24 hours, inventory all LMCache deployments and identify any running in multiprocess/distributed mode with a routable --host or exposed TCP port 5555; immediately restrict access to port 5555 via firewall or security groups to trusted sources only, and where possible rebind LMCache to localhost or a Unix socket or disable multiprocess/distributed mode if not required. Within 7 days, ensure LMCache containers run as a non-root user, apply network segmentation to isolate LMCache nodes, monitor ZeroMQ/msgpack traffic for anomalous messages or unexpected code execution, and review logs for signs of exploitation; if the service must remain network-exposed, place it behind a hardened proxy or VPN with strong access controls. Within 30 days, track the vendor for an official patch (no vendor-released patch identified at time of analysis), test and deploy it as soon as available, and conduct a compromise assessment including credential rotation for any potentially exposed systems; document compensating controls and update architecture to avoid pickle-based deserialization of untrusted data or reduce exposed distributed mode.

LMCache CVE-2026-105192

EUVD-2026-94261 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-10-07 JFROG

GHSA-vv44-hjm2-qw2f

Deserialization Lmcache

9.8

CVSS 3.1 · Vendor: JFROG

Severity by source

Vendor (JFROG) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated single-message pickle RCE gives PR:N/AC:L/UI:N and full C/I/A; AV:N reflects the intended distributed --host mode, though default localhost binding makes AV:L the practical case for single-node installs.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (JFROG).

CVSS VectorVendor: JFROG

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 10:15 vuln.today

CVE Published

Oct 07, 2026 - 09:40 cve.org

CRITICAL 9.8

DescriptionCVE.org

LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect.

AnalysisAI

Remote code execution in LMCache multiprocess (distributed) mode allows unauthenticated attackers to execute arbitrary code as the LMCache process user by sending a crafted msgpack message with extension code 1 to the ZeroMQ ROUTER transport (default TCP port 5555). The flaw occurs because DeviceIPCWrapper.Deserialize calls pickle.loads on untrusted data before the request handler runs; official container images run as root, amplifying impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires LMCache to be running in multiprocess/distributed mode, which opens the unauthenticated ZeroMQ ROUTER transport (default TCP 5555) with no authentication on the socket. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All severity signals point the same direction technically: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially exploitable, unauthenticated, network-reachable flaw, and CWE-502 (untrusted pickle.loads) combined with containers running as root justifies the C:H/I:H/A:H impact and 9.8 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified in the available data; consult the LMCache GitHub repository and PyPI page for updates. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all LMCache deployments and identify any running in multiprocess/distributed mode with a routable --host or exposed TCP port 5555; immediately restrict access to port 5555 via firewall or security groups to trusted sources only, and where possible rebind LMCache to localhost or a Unix socket or disable multiprocess/distributed mode if not required. …

Threat intelligence, references, and detailed analysis are available after sign-in.