A critical LMCache vulnerability can let unauthenticated attackers execute code on AI inference servers, potentially with root privileges. GajIPS detects exploitation attempts at the network layer
Severity: Critical | Priority: 1
These GajIPS rules provide network-layer detection for exploitation of CVE-2026-105192, an unauthenticated remote code execution flaw in LMCache rated 9.8. LMCache is open-source software that speeds up LLM inference servers such as vLLM. In multiprocess mode, the cache runs as a standalone server that LLM workers reach over ZeroMQ. That socket has no authentication, and one message type is unpacked with Python pickle before its type is checked, so a single crafted message runs the attacker's code with the privileges of the LMCache process, which is root on the project's official container images. LMCache 0.3.9 through 0.5.5, the 0.5.6 release candidates and the development branch are affected, and no patched release is available.
If any of these rules trigger in your network, treat the destination host as potentially compromised. A match means a pickle payload carrying a command-execution or code-evaluation call reached the host. If the target runs LMCache in multiprocess mode or another ZeroMQ-based inference service, assume the payload executed with the service's privileges, which may be root. Isolate the host, review the process tree and outbound connections of the LMCache or inference process, and rotate any model-registry, cloud or API credentials accessible from that system. If the source address is internal, also investigate the source host as a likely foothold for lateral movement.