LMCache漏洞評測：vLLM快取層爆CVSS 9.8嚴重漏洞

By Kit 小克 | AI Tool Observer | 2026-10-11

🇹🇼 LMCache漏洞評測：vLLM快取層爆CVSS 9.8嚴重漏洞

LMCache漏洞是本週AI基礎設施圈最熱的資安話題。資安廠商JFrog於2026年10月7日揭露一個CVSS評分高達9.8分的嚴重漏洞，編號CVE-2026-105192，影響廣泛用於加速vLLM等大型語言模型推論服務的開源快取工具LMCache。攻擊者不需要任何帳號密碼，只要對外送出一則惡意的ZeroMQ訊息，就能在快取伺服器上執行任意程式碼，而且截至目前官方仍未釋出修補版本。

LMCache漏洞是什麼？為什麼可以直接拿到root權限？

LMCache是一套讓LLM推論伺服器共享、重複利用KV快取的開源工具，被vLLM等主流推論框架廣泛整合，用來省算力、加速回應。問題出在LMCache用ZeroMQ做跨行程通訊時，監聽5555埠的ROUTER socket完全沒有加密或身分驗證，資料解碼時又透過msgpack擴充格式呼叫了Python的pickle.loads。對不受信任來源呼叫pickle.loads等於開後門——攻擊者精心打造一個惡意pickle物件塞進ZeroMQ訊息，LMCache就會在驗證來源前先把它反序列化執行。官方容器映像又是用root權限跑這個服務，等於一次攻陷整台機器。

哪些版本受影響？修好了嗎？

受影響版本：LMCache 0.3.9（2025年10月發布）到目前最新穩定版0.5.5，連0.5.6的release candidate與開發分支也中標
修補狀態：截至JFrog揭露當下，官方尚未釋出修補版本
攻擊門檻：不需認證，單一則ZeroMQ訊息打到5555埠即可觸發，網路上已經流出PoC（概念驗證）攻擊程式

自架vLLM搭配LMCache的人現在該做什麼？

在官方修補版釋出前，JFrog建議的應急措施是：把LMCache的5555埠用防火牆隔離、不要暴露在公開網路；如果一定要跨主機通訊，至少加上CURVE加密或HMAC驗證；長期則要把pickle.loads換成安全的序列化格式。如果你的團隊有自架vLLM做推論加速，這是本週最優先該檢查的項目，比追新模型更急。

小克老實說

比起鬧得沸沸揚揚的提示注入或AI代理擅自行動事件，LMCache漏洞其實是傳統老派的軟體安全問題——不驗證輸入就反序列化，這種坑Python生態圈踩了十幾年。但套在AI基礎設施上殺傷力更大，因為多數團隊衝模型效能、串接推論框架時，根本沒把「這台快取伺服器是不是暴露在網路上」當一回事。這次事件提醒大家：AI安全不是只防模型講幹話，底層開源元件一樣要定期掃漏洞、做資產盤點。

好不好用，試了才知道。

🇺🇸 LMCache Review: Critical CVSS 9.8 RCE Flaw Hits vLLM

LMCache Vulnerability Review: Critical CVSS 9.8 Flaw Hits vLLM

A newly disclosed LMCache vulnerability is the hottest AI infrastructure security story this week. On October 7, 2026, security firm JFrog disclosed a critical flaw scoring CVSS 9.8, tracked as CVE-2026-105192, in LMCache — the open-source caching layer widely used to speed up LLM inference servers like vLLM. An attacker needs no credentials at all: a single malicious ZeroMQ message is enough to execute arbitrary code on the cache server, and as of now there is still no patched release.

What Is the LMCache Vulnerability, and Why Does It Grant Root?

LMCache is an open-source tool that lets LLM inference servers share and reuse KV cache, widely integrated into frameworks like vLLM to save compute and speed up responses. The problem: LMCache uses ZeroMQ for inter-process communication, and the ROUTER socket listening on port 5555 has zero encryption or authentication. When decoding incoming data, a msgpack extension handler calls Python's pickle.loads — calling pickle.loads on untrusted input is effectively an open backdoor. An attacker crafts a malicious pickle object inside a ZeroMQ message, and LMCache deserializes and executes it before validating where it came from. Since official container images run this service as root, one message compromises the entire machine.

Which Versions Are Affected? Is There a Fix?

Affected versions: LMCache 0.3.9 (released October 2025) through the current stable 0.5.5, plus the 0.5.6 release candidate and dev branch
Patch status: as of JFrog's disclosure, no fixed version has shipped
Attack bar: unauthenticated — a single ZeroMQ message to port 5555 triggers it, and a public proof-of-concept exploit is already circulating

What Should Teams Running vLLM + LMCache Do Right Now?

Until an official patch ships, JFrog's interim guidance is: firewall off port 5555 so LMCache is never exposed to the public network; if cross-host communication is required, add CURVE encryption or HMAC authentication at minimum; and long-term, replace pickle.loads with a safe serialization format. If your team self-hosts vLLM with LMCache for inference acceleration, this is the top item to check this week — ahead of chasing the next model release.

Kit's Honest Take

Compared to the recent wave of prompt-injection and rogue-agent headlines, the LMCache vulnerability is actually an old-school software security problem — deserializing untrusted input without validation, a mistake the Python ecosystem has been tripping over for over a decade. But bolted onto AI infrastructure, the blast radius is bigger, because most teams racing to optimize model performance never stopped to ask whether their cache server was exposed to the network. The lesson here: AI security isn't just about stopping models from misbehaving — the open-source components underneath need regular vulnerability scanning and asset inventory too.

好不好用，試了才知道。
You won't know until you try it.

Sources / 資料來源

常見問題 FAQ

LMCache漏洞（CVE-2026-105192）是什麼？

LMCache在用ZeroMQ做跨行程通訊時，對未驗證來源的資料呼叫Python的pickle.loads，攻擊者只要送一則惡意訊息到5555埠，就能在沒有帳號密碼的情況下於快取伺服器上執行任意程式碼，CVSS評分達9.8分。

LMCache漏洞修好了嗎？

截至目前官方尚未釋出修補版本，受影響版本從0.3.9到最新穩定版0.5.5都中標，網路上已有PoC攻擊程式流出。

自架vLLM的人該怎麼應對LMCache漏洞？

建議立刻用防火牆隔離5555埠、不要暴露在公開網路，跨主機通訊至少加上CURVE或HMAC驗證，長期則應將pickle.loads換成安全的序列化格式。

LMCache漏洞跟其他AI資安事件有什麼不同？

這次問題不是模型本身的提示注入或代理失控，而是傳統的反序列化安全漏洞，但因為架在AI推論基礎設施上，一旦被利用影響範圍更大。

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士