{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/zeromq/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:lmcache:lmcache:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-105192"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LMCache (\u003e= 0.3.9, \u003c 0.5.6)"],"_cs_severities":["critical"],"_cs_tags":["rce","deserialization","multiprocess","zeromq"],"_cs_type":"advisory","_cs_vendors":["LMCache"],"content_html":"\u003cp\u003eLMCache is vulnerable to unauthenticated remote code execution (RCE) via unsafe pickle deserialization in its multiprocess (distributed) mode transport. The vulnerability exists in the ZeroMQ ROUTER socket that LMCache opens to allow worker processes to register and share KV cache blocks. This socket lacks authentication mechanisms such as CURVE, ZAP, or password validation. By default, the transport binds to localhost, but it becomes remotely exploitable when operators bind it to routable network interfaces using the --host parameter.\u003c/p\u003e\n\u003cp\u003eAn attacker can send a crafted msgpack-encoded message to the transport port (default 5555) containing a malicious pickle payload within a register request. This payload is deserialized via \u003ccode\u003epickle.loads\u003c/code\u003e inside \u003ccode\u003eDeviceIPCWrapper.Deserialize\u003c/code\u003e before the application handler validates the input. The code executes with the privileges of the LMCache process, which, in official container images, runs as root. The vulnerability affects LMCache versions 0.3.9 through 0.5.5 and related release candidates.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network reconnaissance to identify reachable LMCache ZeroMQ transport ports (default 5555).\u003c/li\u003e\n\u003cli\u003eAttacker generates a malicious pickle object designed to execute arbitrary OS commands (e.g., \u003ccode\u003eos.system\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker encodes the malicious payload using the \u003ccode\u003emsgspec.msgpack\u003c/code\u003e format, specifically targeting the extension code 1 used by \u003ccode\u003eDeviceIPCWrapper\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a \u003ccode\u003eREGISTER_KV_CACHE\u003c/code\u003e message frame containing the malformed serialized object.\u003c/li\u003e\n\u003cli\u003eAttacker uses a ZMQ DEALER socket to send the multipart message to the target LMCache server.\u003c/li\u003e\n\u003cli\u003eThe LMCache server receives the message and triggers the vulnerable \u003ccode\u003epickle.loads\u003c/code\u003e function during the argument decoding phase.\u003c/li\u003e\n\u003cli\u003eThe arbitrary command executes on the host with the permissions of the LMCache service process.\u003c/li\u003e\n\u003cli\u003eAttacker achieves persistent access, data exfiltration, or further lateral movement within the container or host environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated attackers to achieve full remote code execution on any LMCache node where the ZMQ transport is bound to a routable IP address. Official container images are documented to run the LMCache process as root, elevating the severity of the exploit to full system compromise. If the service is left on default localhost bindings, the impact is limited to local privilege escalation or container escape if reachable by other processes on the same host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to LMCache 0.5.6 or later, which replaces pickle with typed MessagePack descriptors and adds input validation.\u003c/li\u003e\n\u003cli\u003eApply firewall rules or network policies to restrict access to TCP port 5555, ensuring only trusted peer traffic is permitted.\u003c/li\u003e\n\u003cli\u003eReconfigure the LMCache deployment to bind the transport to localhost unless multi-node functionality is strictly required.\u003c/li\u003e\n\u003cli\u003eRun the LMCache service as a non-privileged user rather than root to reduce the blast radius of potential compromises.\u003c/li\u003e\n\u003cli\u003eAudit logs and network connections to port 5555 for any anomalies, as the server will log a type error after the malicious payload has already been executed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T22:28:14Z","date_published":"2026-10-16T22:28:14Z","id":"https://feed.craftedsignal.io/briefs/2026-10-lmcache-rce/","summary":"LMCache versions 0.3.9 through 0.5.5 are vulnerable to unauthenticated remote code execution due to insecure pickle deserialization within the multiprocess ZeroMQ transport layer.","title":"Remote Code Execution in LMCache Multiprocess ZMQ Transport","url":"https://feed.craftedsignal.io/briefs/2026-10-lmcache-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Zeromq","version":"https://jsonfeed.org/version/1.1"}