Key points
- CVE-2026-105192 affects LMCache versions 0.3.9 through 0.5.5.
- The vulnerability enables unauthenticated remote code execution via Pickle deserialization.
- Official container images run the vulnerable process as root, amplifying the risk.
LMCache contains a critical security flaw that permits unauthenticated remote code execution through its multiprocess ZeroMQ transport. According to GitHub advisory GHSA-w5f2-9q9c-ff4h, this issue affects Python packages installed via pip from version 0.3.9 up to, but not including, 0.5.6. The vulnerability is particularly severe for organizations running multi-node deployments where the service binds to routable network addresses rather than localhost.
By the numbers
- 9.8: CVSS score assigned to the routable configuration of the flaw.
- 5555: Default port number for the vulnerable ZMQ transport listener.
- 0.5.5: Latest PyPI release confirmed to contain the vulnerability.
What the figures mean
The high severity score reflects the ease of exploitation when the service is exposed to a network. Attackers can send a single unauthenticated message to port 5555 to trigger code execution. Because official container images run the LMCache process as root, successful exploitation grants attackers full control over the host system. Single-host installations that leave the default localhost binding are not reachable from external machines and face lower risk.
What should you do?
Managed service providers must verify if any client environments use LMCache in distributed mode. Teams should check network configurations to ensure the ZMQ transport is not bound to public or routable interfaces. If the service is exposed, immediate isolation is required until a patch is applied. Monitor for unusual outbound traffic from containers running LMCache, as this may indicate active exploitation.
Operational impact
Organizations should ask whether any production workloads use LMCache in multiprocess mode with network-exposed ports. Security teams need to determine if current container images run processes as root, which increases blast radius. Incident response plans must account for potential full system compromise. Internal communications should alert infrastructure owners to audit network bindings and restrict access to port 5555. Vendor relationships require confirmation of patch timelines and deployment schedules.
Background: Incident response plans
Incident response plans fail when teams assume they cover every attack vector or treat them as static documents. You must focus on decision trees, not scripts. Plan for communication breakdowns, not just technical fixes. Regular table-top exercises reveal gaps that documentation hides.
Read the full guide: Fix Incident Response Plans That Fail Under Pressure
What to do and how to stay safe: LMCache
- Audit all LMCache installations to confirm they are not running vulnerable versions 0.3.9 through 0.5.5.
- Verify that the ZMQ transport is bound only to localhost unless multi-node connectivity is strictly required.
- Restrict network access to port 5555 using firewalls or security groups to prevent unauthenticated connections.
- Monitor system logs for unexpected process executions or privilege escalations on hosts running LMCache.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which LMCache versions are vulnerable to CVE-2026-105192?
Versions 0.3.9 through 0.5.5 are vulnerable. Release candidates up to 0.5.6rc3 are also affected.
Is the vulnerability present in single-host deployments?
No, if the service uses the default localhost binding, it is not reachable from other machines.
What is the impact of successful exploitation?
Attackers can execute code as the user running the LMCache process, which is root in official images.
