Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely

A critical unpatched vulnerability has been discovered in LMCache, an open-source caching layer designed to accelerate large language model (LLM) servers like vLLM. The flaw resides in LMCache's multiprocess mode, where the cache operates as a standalone server communicating with LLM workers via the ZeroMQ messaging library. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code on the cache server without any credentials. No fixed version is currently available, leaving all users of the affected component exposed. The vulnerability is particularly concerning given the growing adoption of LLM infrastructure in enterprise and cloud environments. The use of ZeroMQ without proper authentication mechanisms appears to be the root cause of the issue. Organizations running LMCache in multiprocess mode are advised to isolate the service from untrusted networks as a temporary mitigation.