What happened
LMCache's multiprocess/distributed mode opens an unauthenticated ZeroMQ ROUTER (default port 5555) so workers can share KV cache blocks. Messages are msgpack, and extension code 1 is passed to DeviceIPCWrapper.Deserialize which calls pickle.loads while still decoding request arguments. A single unauthenticated ZMQ message therefore executes code as the LMCache process — root in the official container images — when the transport is bound to a routable address as multi-node deployments do.
Why it matters
LMCache is the KV-cache tier that many teams bolt onto vLLM inference servers; an attacker who can reach the transport port gets pre-auth RCE on the model-serving host, can read/write model weights and prompt caches, and pivot into the serving cluster. It is squarely an AI-serving-infrastructure flaw. A sibling/related issue (CVE-2026-107204) and an opt-in /run_script endpoint broaden exposure.
Attack vector
Single unauthenticated ZMQ DEALER message to the transport port carrying a crafted msgpack extension that triggers pickle.loads
Affected systems
LMCache 0.3.9 through 0.5.5 (and 0.5.6 release candidates) used as the KV-cache layer for vLLM; exposed when the ZeroMQ transport binds a routable address / example K8s manifests bind all interfaces
Mitigation
Upgrade to LMCache 0.5.6 (replaced pickle with versioned typed MessagePack; example K8s manifest now binds localhost, images run non-root). Until then keep the transport on localhost/trusted cluster, firewall port 5555, and run as non-root