An attacker can send a crafted msgpack-encoded message to the transport port (default 5555) containing a malicious pickle payload within a register request. This payload is deserialized via pickle.loads inside DeviceIPCWrapper.Deserialize before the application handler validates the input. The code executes with the privileges of the LMCache process, which, in official container images, runs as root. The vulnerability affects LMCache versions 0.3.9 through 0.5.5 and related release candidates.

Attack Chain

1. Attacker performs network reconnaissance to identify reachable LMCache ZeroMQ transport ports (default 5555).
2. Attacker generates a malicious pickle object designed to execute arbitrary OS commands (e.g., os.system).
3. Attacker encodes the malicious payload using the msgspec.msgpack format, specifically targeting the extension code 1 used by DeviceIPCWrapper.
4. Attacker constructs a REGISTER_KV_CACHE message frame containing the malformed serialized object.
5. Attacker uses a ZMQ DEALER socket to send the multipart message to the target LMCache server.
6. The LMCache server receives the message and triggers the vulnerable pickle.loads function during the argument decoding phase.
7. The arbitrary command executes on the host with the permissions of the LMCache service process.
8. Attacker achieves persistent access, data exfiltration, or further lateral movement within the container or host environment.

Impact

The vulnerability allows unauthenticated attackers to achieve full remote code execution on any LMCache node where the ZMQ transport is bound to a routable IP address. Official container images are documented to run the LMCache process as root, elevating the severity of the exploit to full system compromise. If the service is left on default localhost bindings, the impact is limited to local privilege escalation or container escape if reachable by other processes on the same host.

Recommendation

• Upgrade to LMCache 0.5.6 or later, which replaces pickle with typed MessagePack descriptors and adds input validation.
• Apply firewall rules or network policies to restrict access to TCP port 5555, ensuring only trusted peer traffic is permitted.
• Reconfigure the LMCache deployment to bind the transport to localhost unless multi-node functionality is strictly required.
• Run the LMCache service as a non-privileged user rather than root to reduce the blast radius of potential compromises.
• Audit logs and network connections to port 5555 for any anomalies, as the server will log a type error after the malicious payload has already been executed.