CVE-2026-105192

Summary

This flaw allows unauthenticated attackers to execute arbitrary code as the user running the LMCache process, which can be exploited by sending a specially crafted ZeroMQ message.

Exploitability

Exploitation is relatively straightforward as it requires sending a single unauthenticated ZMQ message to the transport port, which is defaulting to localhost.

Blast radius

If exploited, the impact is high as it can lead to complete compromise of the system running the LMCache process, especially if it is running as root.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the LMCache multiprocess mode or ensure that the transport port is not exposed to untrusted networks by setting the --host option to a non-routable address.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.