CVE-2026-106037: fallo crítico en kvcache-ai Mooncake
Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service
Publicada el
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.7%
probabilidad de explotación
0.7%top 48% de las CVE
explotación observada
noninguna fuente lo reporta
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user prompts, inject or delete objects, and mount attacker-described segments.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
kvcache-ai · MooncakeCVEs relacionadas — kvcache-ai Mooncake
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-103764CRITICALMooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP TransportEPSS 0.6%CVE-2026-103765HIGHMooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata ServerEPSS 0.5%CVE-2026-106038HIGHMooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCsEPSS 0.5%CVE-2026-103760HIGHMooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response WriteEPSS 0.4%CVE-2026-106040HIGHMooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPCEPSS 0.4%CVE-2026-104433HIGHMooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readStringEPSS 0.4%
Referencias
https://github.com/kvcache-ai/Mooncakehttps://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-wheel/mooncake/mooncake_store_service.py#L240-L282https://github.com/kvcache-ai/Mooncake/issues/4476https://www.vulncheck.com/advisories/mooncake-through-0.3.13-post1-missing-authentication-in-store-rest-service