<![CDATA[🔴 Critical: Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely]]>A critical security issue has been identified in LMCache, an open-source caching layer used to accelerate large language model servers such as vLLM. According to the report, the flaw allows an unauthenticated attacker to execute code on the cache server, and as of now there is no fixed version available.

The vulnerability resides in LMCache's multiprocess mode, where the cache operates as a standalone server that LLM workers connect to via the ZeroMQ messaging library. The article indicates that a single network interaction is enough to trigger the issue, meaning an attacker does not need credentials or prior access to the service. Because the cache server communicates directly with LLM workers, successful exploitation could give an intruder a foothold in the inference infrastructure.

Key points from the report:

  • Affected component: LMCache running in multiprocess mode
  • Communication layer involved: ZeroMQ
  • Attack vector: unauthenticated, remote
  • Impact: arbitrary code execution on the cache server
  • Patch status: no fixed version available at the time of reporting

No specific CVE identifier, advisory number, or affected version list was provided in the source material, so none is cited here. Administrators running LMCache in multiprocess mode should treat this as a high-priority exposure and consider isolating cache servers from untrusted networks, restricting access to the ZeroMQ endpoints, and monitoring for unexpected connections until an official fix is released.

Source: The Hacker News

Is your organization running LMCache in multiprocess mode, and if so, what steps are you taking to limit exposure while no patch exists?

]]>https://xploitlk.com/topic/654/critical-unpatched-critical-lmcache-flaw-lets-unauthenticated-attackers-run-code-remotelyRSS for NodeTue, 27 Oct 2026 08:53:58 GMTMon, 12 Oct 2026 00:30:19 GMT60