Summary
LMCache multiprocess mode exposes an unauthenticated ZeroMQ transport that can process attacker-controlled messages using unsafe Python deserialization. If the transport is reachable, a single crafted request may execute arbitrary code with the privileges of the LMCache process, potentially including root in official container deployments.
LMCache multiprocess mode exposes an unauthenticated ZeroMQ transport that can process attacker-controlled messages using unsafe Python deserialization. If the transport is reachable, a single crafted request may execute arbitrary code with the privileges of the LMCache process, potentially including root in official container deployments.
Affected context
The vulnerability occurs in LMCache multiprocess or distributed mode when its ZeroMQ ROUTER transport is reachable by an attacker. The service listens on port 5555 by default and typically binds to localhost, but deployments that configure a routable host for multi-node operation may expose the transport beyond the local machine. Messages using the affected extension path are deserialized before normal request handling and authentication controls, if any, can apply.
The vulnerability occurs in LMCache multiprocess or distributed mode when its ZeroMQ ROUTER transport is reachable by an attacker. The service listens on port 5555 by default and typically binds to localhost, but deployments that configure a routable host for multi-node operation may expose the transport beyond the local machine. Messages using the affected extension path are deserialized before normal request handling and authentication controls, if any, can apply.
Exploit preconditions
- Attack surface: LMCache's ZeroMQ transport port, commonly 5555
- Required access: Network connectivity to the transport; no application authentication is required
- Trigger point: Processing an extension message during request decoding
- Why exploitation is possible: Attacker-controlled serialized data reaches
pickle.loadsbefore the request handler runs - Privilege context: Code executes with the permissions of the LMCache process, which may be root in official container images
- Attack surface: LMCache's ZeroMQ transport port, commonly 5555
- Required access: Network connectivity to the transport; no application authentication is required
- Trigger point: Processing an extension message during request decoding
- Why exploitation is possible: Attacker-controlled serialized data reaches
pickle.loadsbefore the request handler runs - Privilege context: Code executes with the permissions of the LMCache process, which may be root in official container images
Why this happens
The underlying issue combines an unauthenticated network service with unsafe deserialization. Data received through the ZeroMQ transport is decoded as msgpack, and a specific extension path passes serialized content to pickle.loads, which can reconstruct arbitrary Python objects and invoke attacker-controlled behavior. This maps primarily to CWE-502: Deserialization of Untrusted Data; the absence of authentication or authorization on the transport also relates to CWE-306: Missing Authentication for Critical Function.
The underlying issue combines an unauthenticated network service with unsafe deserialization. Data received through the ZeroMQ transport is decoded as msgpack, and a specific extension path passes serialized content to pickle.loads, which can reconstruct arbitrary Python objects and invoke attacker-controlled behavior. This maps primarily to CWE-502: Deserialization of Untrusted Data; the absence of authentication or authorization on the transport also relates to CWE-306: Missing Authentication for Critical Function.
Potential impact
- An attacker may execute arbitrary code in the LMCache process
- The attacker could access, alter, or delete cached data and application resources
- Compromise may extend to credentials, mounted files, or connected services
- A root-running container could allow more extensive container compromise
- Inadequate network isolation could enable lateral movement within the deployment
- An attacker may execute arbitrary code in the LMCache process
- The attacker could access, alter, or delete cached data and application resources
- Compromise may extend to credentials, mounted files, or connected services
- A root-running container could allow more extensive container compromise
- Inadequate network isolation could enable lateral movement within the deployment
General mitigation guidance
Mitigation generally focuses on removing unsafe deserialization and reducing exposure of the transport interface.
Common defensive patterns include:
- Replacing object-capable deserialization with safe, schema-constrained data formats
- Rejecting unsupported message types before processing serialized content
- Requiring mutual authentication and authorization for inter-process or inter-node transport
- Binding services to private interfaces and restricting access with network policy or firewall controls
- Running LMCache as a dedicated non-root user with minimal filesystem and network privileges
- Avoiding broad host exposure when local or private service discovery is sufficient
- Treating cache transport messages as untrusted even within an internal network
Mitigation generally focuses on removing unsafe deserialization and reducing exposure of the transport interface.
Common defensive patterns include:
- Replacing object-capable deserialization with safe, schema-constrained data formats
- Rejecting unsupported message types before processing serialized content
- Requiring mutual authentication and authorization for inter-process or inter-node transport
- Binding services to private interfaces and restricting access with network policy or firewall controls
- Running LMCache as a dedicated non-root user with minimal filesystem and network privileges
- Avoiding broad host exposure when local or private service discovery is sufficient
- Treating cache transport messages as untrusted even within an internal network
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying
pickle.loadsor equivalent object deserialization on network-derived data - Code review checks for unauthenticated ZeroMQ ROUTER or DEALER endpoints
- Dependency and configuration reviews that identify routable transport bindings
- Runtime monitoring for unexpected connections to the LMCache transport port
- Network policy audits confirming that only authorized worker peers can reach the endpoint
- Container posture checks for root execution and excessive mounted credentials
Automated security review tools may help flag unsafe deserialization APIs and missing access-control checks during development.
Organizations can look for this class of issue through:
- Static analysis rules identifying
pickle.loadsor equivalent object deserialization on network-derived data - Code review checks for unauthenticated ZeroMQ ROUTER or DEALER endpoints
- Dependency and configuration reviews that identify routable transport bindings
- Runtime monitoring for unexpected connections to the LMCache transport port
- Network policy audits confirming that only authorized worker peers can reach the endpoint
- Container posture checks for root execution and excessive mounted credentials
Automated security review tools may help flag unsafe deserialization APIs and missing access-control checks during development.
