On October 7, 2026, JFrog published an advisory for CVE-2026-105192 in LMCache, a caching library used in inference systems. The flaw affects pickle deserialization on the multiprocess ZeroMQ transport, which is distinct from in-process mode. This does not mean the service port is automatically reachable from the internet: exposure depends on network configuration.
The vulnerable path
The advisory lists versions 0.3.9 and later as affected and describes unauthenticated pickle deserialization in the multiprocess ZeroMQ transport. A crafted message can lead to code execution in the LMCache process. Severity is high, but practical risk depends on configuration and network reachability.
Network scope changes the risk
The default local binding limits access to processes on the same machine; the advisory lists port 5555 as the default. A routable configuration, port forwarding, or exposure to an untrusted network expands the attack surface. PK Sharma’s analysis notes that deployment examples can listen on all interfaces: check the effective configuration rather than assuming it remained local.
Mitigation while awaiting a fix
JFrog says versions 0.5.5 and 0.5.6rc3 remain vulnerable and does not list a fixed release. Until a fix is available, disable the vulnerable transport if possible, keep the service on loopback or an isolated network, and filter the port with a firewall. Trust only explicitly authorized peers.
Review containers and processes
Inspect ZeroMQ logs, inbound connections, and unexpected child processes. Assess container images in light of their privileges and environment; containers alone are not a security boundary. Follow project and JFrog advisories to reassess when a fix is released.
How Soclyde fits
Separate human administration access from credentials needed at runtime. Keep administration and orchestration passwords in an encrypted vault apart from LMCache hosts; retain only the runtime credentials strictly needed on the host. Soclyde can help store and share administrative access with authorized people; it does not filter ZeroMQ traffic. See our password security guide or contact us.
What to remember
Check whether LMCache 0.3.9 or later is in use, verify the listening address, and isolate the transport until a fix is released. For credential controls, see our password management guide.
