Unpatched Critical RCE Flaw Found in LMCache LLM Caching Server

A critical, unpatched vulnerability in LMCache, open-source caching software used to speed up LLM servers like vLLM, allows unauthenticated attackers to execute code remotely via its ZeroMQ-based multiprocess cache server. No fixed version is currently available.

Disclosed 7 October 2026 · Record updated 7 October 2026

Impact

Unauthenticated remote code execution possible against LMCache cache servers used by LLM inference infrastructure such as vLLM; no patch currently exists.

Our coverage

Vulnerabilities

Unpatched critical flaw in LMCache lets attackers run code

The open-source caching layer used to speed up LLM servers such as vLLM has no fixed version available, according to a report published on 7 October 2026.

7 Oct 2026

Sources

thehackernews.comhttps://thehackernews.com/2026/10/unpatched-critical-lmcache-flaw-lets.html