CVE-2026-105192: LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization

LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization

Exact source revision recorded 29 Oct 2026 12:12:12 UTC. It does not establish the source's current position. Latest evidence.

lmcache

https://pypi.org/project/lmcache/

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "LMCache",
                    "product": "LMCache",
                    "collectionURL": "https://pypi.org/project/lmcache/",
                    "packageName": "lmcache",
                    "repo": "git://github.com/LMCache/LMCache",
                    "programFiles": [
                        "lmcache/v1/multiprocess/transport/zmq_impl/mq.py",
                        "lmcache/v1/multiprocess/mq.py",
                        "lmcache/v1/multiprocess/custom_types.py",
                        "lmcache/v1/platform/base/ipc_wrapper.py",
                        "lmcache/v1/platform/base_ipc_wrapper.py"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0.3.9",
                            "lessThan": "0.5.6",
                            "versionType": "python"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

cve-program · CVE-2026-105192

lmcache