LMCache

Security researchers are flagging CVE-2026-105192, a CVSS 9.8 remote code execution vulnerability in LMCache, the KV-cache server used with the vLLM inference framework. In multiprocess mode, an unauthenticated ZeroMQ socket unpickles attacker-controlled data, allowing code execution as root on official images. Versions 0.3.9 through 0.5.5 are affected, and no fix is currently available, raising concern among teams running AI infrastructure.

Security researchers have disclosed an unpatched critical remote code execution vulnerability in LMCache, the KV-cache server used alongside the vLLM inference framework. In multiprocess mode, an unauthenticated attacker can execute arbitrary code over ZeroMQ. No fixed version is available yet, leaving deployments exposed until a patch or mitigation is released.