Tools AI Risk Radar ai-incident-0231
Incident record
LMCache distributed transport allowed unauthenticated code execution
- Severity
- Critical
- Status
- Patched
- Type
- Infra Vuln
- Target
- LMCache multiprocess transport
- Actor
- researcher
- CVE
- CVE-2026-105192
What happened
An attacker able to reach the multiprocess transport could trigger unsafe deserialisation and run code as the LMCache process.
The advisory assigns CVSS 9.8 to deployments bound to a network-reachable address. The default transport binds to localhost; the affected distributed path was introduced in 0.3.9 and fixed in 0.5.6. The disclosure describes researcher testing.
Sources
- Maintainer security advisorygithub.com/LMCache/LMCache/security/advisories/GHSA-w5f2-9q9…
- GitHub reviewed advisorygithub.com/advisories/GHSA-w5f2-9q9c-ff4h
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026