CVE-2026-103761

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. They can poison segment descriptors or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. They can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.

A vulnerability was found in kvcache-ai mooncake up to version 0.3.12/0.3.14-rc1 in the MasterService::GetReplicaListByRegex function. Performing a manipulation leads to allocation of resources. The attack may be performed remotely and the exploit has been made public.

A vulnerability was found in kvcache-ai mooncake up to version 0.3.12/0.3.13.post1/0.3.14-rc1 in the ScopedSegmentAccess::MountSegment function. Performing a manipulation results in improper access controls. The attack can be performed remotely and the exploit has been released.

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1 in the UnmountSegment function of the RPC Path Handler component. Manipulation of the client_id/segment_id arguments causes authorization bypass. Remote exploitation is possible and the exploit has been publicly disclosed.