Unpatched critical flaw in LMCache lets attackers run code

A critical vulnerability in LMCache, the open-source software used to speed up large language model servers, allows an attacker to run code on a cache server without logging in, according to a report published by The Hacker News on 7 October 2026. No fixed version is available.

LMCache is a caching layer that sits alongside LLM serving software such as vLLM, which runs models behind an API. Caching stores previously computed data so that repeated work does not have to be done again, which cuts the time and compute cost of serving model responses. The project is widely paired with vLLM for that reason.

The flaw sits in LMCache's multiprocess mode, the report said. In that configuration the cache does not run inside the same process as the model server. Instead it runs as a standalone server, and the LLM worker processes reach it over ZeroMQ, a messaging library used to pass data between programs. That design means the cache is exposed as a network service rather than as an internal function call.

According to the report, an unauthenticated attacker can exploit that exposure to execute code remotely on the cache server. There is no requirement to hold credentials or an existing session. The underlying problem has been characterised as excessive permissions in the way the cache server handles what it receives.

There is currently no patched release. That leaves operators dependent on their own controls rather than on an upstream fix. The usual first question for anyone running LMCache in multiprocess mode is whether the ZeroMQ endpoint is reachable from anywhere other than the machines that are supposed to talk to it.

The disclosure matters for teams building agent systems because inference infrastructure is rarely treated as part of the attack surface. A cache server is plumbing. It is often deployed inside a cluster, assumed to be internal, and given network access to the same hosts that run the model workers. If code execution on that host is possible without authentication, the trust placed in it by the serving stack becomes the problem rather than a mitigation.

The report does not state that the flaw has been exploited, and no affected deployments have been named. It does not give a count of installations at risk.

Operators of LLM serving stacks that include LMCache should check whether multiprocess mode is enabled and review network exposure of the cache service while waiting for an upstream release. Users who run LMCache only in its in-process configuration are not described as being in scope of the issue in the report.