CVE-2026-106040: fallo de gravedad alta en kvcache-ai Mooncake
Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.4%
probabilidad de explotación
0.4%top 70% de las CVE
explotación observada
noninguna fuente lo reporta
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Productos afectados
kvcache-ai · MooncakeCVEs relacionadas — kvcache-ai Mooncake
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-106037CRITICALMooncake through 0.3.13.post1 Missing Authentication in Store REST ServiceEPSS 0.7%CVE-2026-103764CRITICALMooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP TransportEPSS 0.6%CVE-2026-103765HIGHMooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata ServerEPSS 0.5%CVE-2026-106038HIGHMooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCsEPSS 0.5%CVE-2026-103760HIGHMooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response WriteEPSS 0.4%CVE-2026-104433HIGHMooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readStringEPSS 0.4%
Referencias
https://github.com/kvcache-ai/Mooncakehttps://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L5507-L5515https://github.com/kvcache-ai/Mooncake/issues/4478https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-missing-authorization-via-evictdiskreplica-rpc