🔴 Critical: Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely
-
A critical security issue has been identified in LMCache, an open-source caching layer used to accelerate large language model servers such as vLLM. According to the report, the flaw allows an unauthenticated attacker to execute code on the cache server, and as of now there is no fixed version available.
The vulnerability resides in LMCache's multiprocess mode, where the cache operates as a standalone server that LLM workers connect to via the ZeroMQ messaging library. The article indicates that a single network interaction is enough to trigger the issue, meaning an attacker does not need credentials or prior access to the service. Because the cache server communicates directly with LLM workers, successful exploitation could give an intruder a foothold in the inference infrastructure.
Key points from the report:
- Affected component: LMCache running in multiprocess mode
- Communication layer involved: ZeroMQ
- Attack vector: unauthenticated, remote
- Impact: arbitrary code execution on the cache server
- Patch status: no fixed version available at the time of reporting
No specific CVE identifier, advisory number, or affected version list was provided in the source material, so none is cited here. Administrators running LMCache in multiprocess mode should treat this as a high-priority exposure and consider isolating cache servers from untrusted networks, restricting access to the ZeroMQ endpoints, and monitoring for unexpected connections until an official fix is released.
Source: The Hacker News
Is your organization running LMCache in multiprocess mode, and if so, what steps are you taking to limit exposure while no patch exists?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login