Unauthenticated Remote Code Execution in LMCache Distributed Mode

LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect.

Casky was already ahead

This CVE exploits attack patterns that Casky's 517matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

LMCache's multiprocess distributed mode exposes a critical unauthenticated ZeroMQ ROUTER socket that accepts msgpack-serialized messages from worker processes. The vulnerability exists in the deserialization logic where extension code 1 is passed directly to pickle.loads() during message decoding, before any authentication checks or request handlers execute. This allows an attacker to send a single crafted ZMQ DEALER message to the default transport port (5555) to achieve remote code execution with the privileges of the LMCache process user. The attack requires no authentication credentials and can be exploited by any network actor with access to the exposed port, making this a critical threat to organizations using LMCache for large language model inference acceleration in distributed environments.

Casky's 517 matching security skills enable practitioners to detect the attack patterns associated with this vulnerability across multiple MITRE ATT&ACK tactics. Detection focuses on Initial Access (TA0001) through exposed network services and unusual ZeroMQ traffic patterns, Execution (TA0002) via pickle deserialization anomalies, Privilege Escalation (TA0004) monitoring process privilege levels after message receipt, Defense Evasion (TA0005) techniques that bypass serialization safeguards, and Command and Control (TA0043) indicators from reverse shells or lateral movement following exploitation. Using Claude's extended reasoning capabilities, practitioners would see findings that correlate unauthenticated msgpack messages to port 5555 with subsequent process spawning, unusual pickle module invocations, and privilege context changes—enabling earlier detection of exploitation attempts before they achieve full system compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

517 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-105192.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0004 TA0006 TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-105192

Casky has 517 skills that investigate the attack patterns behind CVE-2026-105192. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn