CVE-2026-105192: LMCache ZeroMQ Pickle Flaw Grants Root RCE on Any Routable Multiprocess Server

The flaw sits in the ZeroMQ registration socket used when LMCache runs as a standalone cache server for vLLM workers. A single network message carries arguments that are immediately unpacked via pickle, executing attacker-controlled code with the privileges of the LMCache process. Official container images run this process as root, and the project's example Kubernetes deployment binds the socket to all interfaces rather than localhost. No authentication or message signing exists on the socket.

JFrog's October 7 disclosure and six additional GitHub reports filed the prior day document the same root pattern seen in the November 2025 ShadowMQ findings across multiple AI inference frameworks. The related vLLM CVE-2026-105756 was fixed in September by rejecting malformed cache_salt values, yet LMCache itself has issued no advisory and no patched release exists. The technical evidence consists of static code review and proof-of-concept message construction; no independent runtime confirmation on production clusters has been published.

Default exposure occurs precisely when operators follow the documented multi-node configuration. A firewall reduces the attack surface but does not eliminate it, because any host that can open the port can execute code. The absence of a detection method in the JFrog advisory means operators cannot determine whether prior exploitation has occurred.

Until a fixed release ships, the only reliable control is keeping the multiprocess server strictly local or on an isolated trusted network segment with no external listeners. Continued use of unauthenticated pickle over network sockets in inference tooling indicates the pattern will recur in other components.