Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely

A critical remote code execution vulnerability (CVE-2026-105192) in LMCache's multiprocess mode allows an unauthenticated attacker to send a crafted ZeroMQ message that is unpickled by the server, executing code as the LMCache process user; affected versions range from 0.3.9 through 0.5.5 and no patch is available. JFrog assigned a 9.8 severity and recommends keeping the multiprocess server bound to localhost or a trusted cluster network; related unconfirmed reports allege additional data-access issues and a separate vLLM denial-of-service (CVE-2026-105756) was fixed.