Unpatched RCE in LMCache Exposes vLLM AI Infrastructure

Wed, 07 Oct 2026 17:48:59 +0000

Engineer — Act: Unpatched critical unauthenticated RCE in LMCache multiprocess mode with no fix available; if running vLLM or any LMCache deployment, immediately disable multiprocess mode or network-isolate the cache server (firewall ZeroMQ port) until a patched release ships.
SOC/IR — Plan: No IOCs or confirmed active exploitation reported, but organizations running LLM inference infrastructure should create detections for anomalous process spawning or unexpected inbound connections on LMCache/vLLM nodes; start collecting relevant host and network logs from AI compute clusters now.
Leader — Learn: Highlights emerging attack surface in enterprise AI infrastructure; no immediate leadership action required, but useful context for AI security posture reviews and vendor risk assessments if LLM serving software is in scope.

Lmcache on CuraSec