CVE-2026-103764
CriticalCVSS 9.8Summary
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. They can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.
Risk Assessment
An attacker can access sensitive data or execute arbitrary code, leading to full system compromise.
Recommendation
Update Mooncake to version 0.3.13 or later and restrict access to the TCP data port to trusted clients only.
Other vulnerabilities in Mooncake
See all- CVE-2026-103761High
Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.
- CVE-2026-103765Critical
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. They can poison segment descriptors or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.
- CVE-2026-96764Medium
A vulnerability was found in kvcache-ai mooncake up to version 0.3.12/0.3.14-rc1 in the MasterService::GetReplicaListByRegex function. Performing a manipulation leads to allocation of resources. The attack may be performed remotely and the exploit has been made public.
- CVE-2026-96763Medium
A vulnerability was found in kvcache-ai mooncake up to version 0.3.12/0.3.13.post1/0.3.14-rc1 in the ScopedSegmentAccess::MountSegment function. Performing a manipulation results in improper access controls. The attack can be performed remotely and the exploit has been released.
- CVE-2026-96762High
A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1 in the UnmountSegment function of the RPC Path Handler component. Manipulation of the client_id/segment_id arguments causes authorization bypass. Remote exploitation is possible and the exploit has been publicly disclosed.
Original NVD description (English source)
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS