Severity: CriticalVulnerabilityModel/inference
Unauthenticated Remote Code Execution in LMCache Open-Source LLM Acceleration Software
Global
Live intelligence. Items are aggregated from public sources and summarised automatically. Always verify against the linked source before acting.
A critical, unpatched vulnerability in LMCache—an open-source caching layer for large language model servers like vLLM—allows unauthenticated remote code execution on the cache server. The flaw exists in LMCache's multiprocess mode where the cache runs as a standalone service accessible via ZeroMQ messaging, and no patched version is currently available.
What to do
Audit and isolate LMCache deployments from untrusted networks pending a security patch; restrict ZeroMQ endpoint access to authenticated, authorized LLM worker processes only.
Mapped framework pillars
Sources
#LMCache#LLM infrastructure#remote code execution#unauthenticated access#vLLM#supply chain