Affected Systems
LMCache versions 0.3.9 through 0.5.5 (including 0.5.6 release candidates and development branch) when multiprocess mode is configured with routable network addresses. Also affects vLLM deployments using LMCache multiprocess connector. Default localhost-only configurations are not remotely exploitable.
Exploitation Status
No active exploitation reported. Proof-of-concept details published by JFrog on October 7, 2026. Exploitation requires LMCache multiprocess server bound to routable address (non-default configuration). No patch available.
Business Impact
Unauthenticated attackers can execute arbitrary code with privileges of the LMCache process (root in official container images). Exploitable only when multiprocess server is configured with routable IP addresses, common in multi-node Kubernetes deployments. Default localhost-only configuration is not remotely exploitable. CVSS 9.8 (Critical). No detection guidance provided by vendor. No patched version available.
Urgency
🔴 Immediate
Recommended Actions
- Immediately audit all LMCache multiprocess deployments to verify cache server binds only to localhost (127.0.0.1), not routable addresses like 0.0.0.0 or external IPs
- For multi-node deployments requiring shared cache, isolate LMCache ZeroMQ port (default varies) to trusted cluster networks using network segmentation and firewall rules allowing only known LLM worker IPs
- Switch to single-process LMCache mode within vLLM if multiprocess cache sharing is not required, as this mode does not expose the vulnerable network port
- Monitor LMCache process logs and network connections to ZeroMQ ports for unexpected external connections; review historical connection logs for compromise indicators
- Subscribe to LMCache GitHub security advisories and plan immediate patching when fixed version releases; consider disabling LMCache multiprocess mode until patch available if risk tolerance is low