Unpatched LMCache Flaw Gives Unauthenticated Root RCE on LLM Inference Cache Servers (CVE-2026-105192)

LMCache, the KV-cache layer used with vLLM, multiprocess mode in versions 0.3.9 through 0.5.5, the 0.5.6 release candidates, and the dev branch

JFrog researcher Yuval Moravchick disclosed that a single ZeroMQ message to the multiprocess server (port 5555) runs code as the LMCache process user, which is root in the official container images. The default bind is localhost, but LMCache's example Kubernetes DaemonSet binds to a routable address. No fix or maintainer advisory existed at disclosure; network isolation is the only mitigation

An unauthenticated ZMQ socket (no CURVE or ZAP) and a msgpack extension that passes attacker data to `pickle.loads` before the message type is checked