CriticalCVECVE-2026-105192
PoC Released for Critical LMCache Flaw Enabling Unauthenticated Remote Code Execution
Cyber Security News·Source published ·1 min read
What happened?
A proof-of-concept (PoC) exploit has been released for a critical vulnerability in LMCache that can allow unauthenticated remote code execution on exposed distributed deployments. Tracked as CVE-2026-105192, the flaw has a CVSS score of 9.8 and affects LMCache versions beginning with 0.3.9. As of October 7, JFrog Security Research reported no fixed release. The vulnerability, identified by Yuval Moravchick of the JFrog Security Research Team, exists in LMCache’s multiprocess mode, also known as distributed mode.
Key details
- Vulnerability exists in multiprocess ZMQ transport that accepts messages without authentication
- PoC demonstrates single unauthenticated ZMQ DEALER message to port 5555 triggers code execution
- Exploitation can lead to root-level control in default container images where process runs as root
Affected
- Default service port 5555 exposed to network
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.