Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely

A critical vulnerability has been discovered in LMCache, an open-source software used to accelerate large language model servers. This flaw allows unauthenticated attackers to execute code remotely on the cache server without needing to log in. The vulnerability is specifically located in LMCache's multiprocess mode, where the cache operates as a standalone server accessed by LLM workers via the ZeroMQ messaging library. An attacker can exploit this flaw over a single network connection. Currently, there is no fixed version of LMCache available to address this issue.