PulseAugur
EN
LIVE 18:47:05

Critical RCE vulnerability found in vLLM's LMCache server

By PulseAugur Editorial · [2 sources] ·

A critical remote code execution vulnerability, CVE-2026-105192 with a CVSS score of 9.8, has been identified in LMCache, a key-value cache server utilized by vLLM. The flaw, present in versions 0.3.9 through 0.5.5, allows unauthenticated attackers to execute arbitrary code as root by exploiting an exposed ZeroMQ socket in multiprocess mode. As of the reports, no patch is available for this vulnerability. AI

IMPACT This critical vulnerability in LMCache, used by vLLM, poses a significant security risk to AI deployments, potentially allowing unauthorized root access.

RANK_REASON Security vulnerability disclosure in an AI infrastructure component.

Read on Mastodon — mastodon.social →

AI-generated summary · Google Gemini · from 2 sources. How we write summaries →

Critical RCE vulnerability found in vLLM's LMCache server

How we ranked this

Signal score
0 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
Security vulnerability disclosure in an AI infrastructure component.
Source corroboration
2 independent sources
Multiple independent publishers reporting the same story raises confidence that it's real and newsworthy.
Topics
infra, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
30 days old
Aged out of breaking-news scoring windows; ranking reflects the durable signal from the full source set.

Full methodology in our editorial standards.

COVERAGE [2]

  1. Mastodon — mastodon.social TIER_1 English(EN) · [email protected] ·

    🤖 CVE-2026-105192 (CVSS 9.8): unpatched RCE in LMCache, the KV-cache server used by vLLM. Multiprocess mode exposes an unauthenticated ZeroMQ socket that unpick

    🤖 CVE-2026-105192 (CVSS 9.8): unpatched RCE in LMCache, the KV-cache server used by vLLM. Multiprocess mode exposes an unauthenticated ZeroMQ socket that unpickles attacker data — code runs as root on official images. No fix; affects 0.3.9–0.5.5. 🔗 https:// thehackernews.com/2026…

    LINKS thehackernews.com/…/unpatched-critical-lm… thehackernews.com/…/unpa
  2. Mastodon — mastodon.social TIER_1 English(EN) · [email protected] ·

    🤖 Unpatched critical RCE in LMCache, the LLM KV-cache server used with vLLM: in multiprocess mode an unauthenticated attacker can run code over ZeroMQ. No fixed

    🤖 Unpatched critical RCE in LMCache, the LLM KV-cache server used with vLLM: in multiprocess mode an unauthenticated attacker can run code over ZeroMQ. No fixed version available yet. 🔗 https:// thehackernews.com/2026/10/unpa tched-critical-lmcache-flaw-lets.html # CyberSec # Exp…

    LINKS thehackernews.com/…/unpatched-critical-lm… thehackernews.com/…/unpa

RELATED ENTITIES

RELATED TOPICS