JFrog disclosed CVE-2026-105192, a critical vulnerability in LMCache that can allow unauthenticated remote code execution. The issue affects LMCache versions 0.3.9 through 0.5.5, according to the disclosure, and was rated 9.8 by JFrog for server deployments exposed to routable networks.
Teams running AI inference infrastructure should immediately identify LMCache instances, determine whether they are reachable from untrusted networks, and apply vendor guidance as it becomes available. Until a fix is deployed, reduce exposure with network segmentation, authentication layers, and monitoring for anomalous process execution.
Because the flaw is reported as unpatched, change-control owners should document compensating controls and reassess them frequently. Validate remediation after deployment rather than relying on inventory status alone.
Source: The Hacker News