CVE-2026-106038
HighCVSS 8.2Summary
Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and request failures.
Risk Assessment
An unauthenticated attacker can delete arbitrary objects or the entire store, leading to data loss and service failures. This can cause severe disruptions to system operations.
Recommendation
Update Mooncake Store to a version later than 0.3.13.post1, which fixes this vulnerability. Restrict access to the coro_rpc master port to trusted networks.
Other vulnerabilities in Mooncake Store
See all- CVE-2026-106041Medium
Mooncake Store through 0.3.13.post1 has a missing authorization vulnerability allowing unauthenticated attackers to inject completed LOCAL_DISK replicas via NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replicas pointing at attacker-controlled endpoints to serve poisoned disk-tier reads and fake key existence.
- CVE-2026-106040High
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk.
- CVE-2026-106039Medium
Mooncake Store through 0.3.13.post1 has a missing authorization vulnerability allowing unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.
Original NVD description (English source)
Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and request failures.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS