What changed
LMCache v0.5.6 was published on 14 October 2026. The release notes lead with security hardening and point at GitHub advisory GHSA-w5f2-9q9c-ff4h, which GitHub published on 16 October 2026 as critical, CVE-2026-105192. The notes say pickle was removed from device IPC descriptors. In multiprocess mode, those handles are no longer serialized with pickle, which the project says closes an arbitrary code execution path across the multiprocess server boundary. The change is pull request 5644.
The advisory describes the path this release closes. Multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. The intended clients are sibling LMCache processes. The advisory says there is no CURVE, ZAP, password, or message authentication on that socket. LMCache used only inside a vLLM process does not open the port. The transport binds to localhost unless the operator sets a routable address. The advisory assigns a 9.8 score to that routable configuration, and says a stock single host install that leaves the default bind is not reachable from other machines.
Messages on the socket are msgpack. The advisory says extension code 1 was registered for DeviceIPCWrapper and passed to a deserialize function that called pickle.loads, while the server was still decoding REGISTERKVCACHE arguments. A single unauthenticated message to the transport port, default 5555, could therefore execute code as the user the LMCache process runs as. The advisory says official container images run that process as root.
The advisory's own narrative, which refers to the tree as of 7 October 2026, said no fixed version had been published and named v0.5.5 and release candidates through v0.5.6rc3 as still affected. The vulnerability record lists the affected range as 0.3.9 up to but not including 0.5.6, and names 0.5.6 as the first patched version. The 14 October release notes are the project's statement that 0.5.6 is that patch. The same notes also disable the /run_script admin endpoint by default and bind the admin HTTP server to localhost unless configured otherwise.
Image: LMCache
Why it matters
KV cache is the memory that lets a long prompt avoid recomputation. Multiprocess mode exists so more than one worker can share it. The advisory's point is that the socket which makes that sharing possible was also a pickle decoder, with no authentication, on a port the process opens. On a laptop that never sets a routable host, other machines cannot reach it. On a multi node deployment that does, the advisory treats the score as 9.8, and the container note says the process is root.
That is a configuration bug as much as a library bug. Leaving multiprocess mode on, and binding it where peers can connect, was a documented way to run. The fix in 0.5.6 removes pickle from that descriptor path. It does not, by itself, add the authentication methods the advisory says were absent.
Who is affected
Operators running lmcache from 0.3.9 up to but not including 0.5.6 in multiprocess mode, especially where the transport is bound to an address other machines can route to. Teams whose inference service uses vLLM with LMCache only inside one process are outside the port the advisory describes. Anyone shipping the official container image should read the root note before deciding how the patched process is started.
What to do next
Move multiprocess deployments to v0.5.6 and confirm the running package is that version, not a nightly tag from the same week. Until the pin is in place, do not set a routable host on the multiprocess transport. After the upgrade, check that the admin HTTP server is still on localhost unless you have a reason to expose it, and that /run_script stays off. Retest a multi node cache share with a peer you control. Do not leave a 0.5.6 release candidate in front of the stable tag.
What to watch
Whether the advisory text that still says no fix had been published, as of 7 October, is revised to match the 0.5.6 notes. Also watch nightly images dated 16 October. A nightly tag is not the release the notes call the fix.
Image: LMCache
Sources
Primary — LMCache, v0.5.6 release notes (14 October 2026). Establishes that pickle was removed from device IPC descriptors for CVE-2026-105192, and that the admin script endpoint defaults to off.
Primary — GitHub Security Advisory, GHSA-w5f2-9q9c-ff4h (16 October 2026). Establishes the unauthenticated ZeroMQ path, the localhost default, the 9.8 score for a routable bind, and the affected range below 0.5.6.
Related in Cyber Security
Continue reading