LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport (CVE-2026-105192)

LMCache's multiprocess mode opens an unauthenticated ZeroMQ ROUTER socket (default port 5555) for worker processes to share cache blocks. This socket accepts msgpack messages that include an extension type deserialized via pickle.loads without authentication, enabling unauthenticated remote code execution. The vulnerability affects versions from 0.3.9 through 0.5.5 and 0.5.6 release candidates prior to the final 0.5.6 release. The default configuration binds to localhost, but multi-node setups often bind to 0.0.0.0 or other routable addresses, exposing the service to network attackers. The official container images run the LMCache process as root, so exploitation leads to root code execution. The issue is fixed in 0.5.6 by removing pickle deserialization, implementing a typed MessagePack allowlist, changing the wire format, binding example deployments to localhost, and running containers as non-root users.

An attacker who can connect to the ZeroMQ transport port (default 5555) on a vulnerable LMCache deployment can send a single crafted message that triggers unsafe pickle deserialization, resulting in arbitrary code execution with the privileges of the LMCache process. Since official containers run LMCache as root, this can lead to full system compromise. Single-host default installs binding only to localhost are not exposed remotely, but multi-node or misconfigured deployments binding to routable addresses are vulnerable. The vulnerability has a CVSS 3.1 score of 9.8 (critical).

A fixed version 0.5.6 is available and should be deployed. This release replaces pickle deserialization with a safe MessagePack-based format and restricts network exposure by binding example deployments to localhost and running as a non-root user. Until upgrading, do not bind the ZeroMQ transport to routable addresses; restrict access to port 5555 with firewalls or network controls to trusted hosts only.