CVE-2026-96763
MediumCVSS 5.4Summary
A vulnerability was found in kvcache-ai mooncake up to version 0.3.12/0.3.13.post1/0.3.14-rc1 in the ScopedSegmentAccess::MountSegment function. Performing a manipulation results in improper access controls. The attack can be performed remotely and the exploit has been released.
Risk Assessment
The organization is exposed to unauthorized access to data segments, which could lead to confidentiality or data integrity breaches.
Recommendation
It is recommended to update mooncake to a version newer than 0.3.14-rc1 and implement proper access controls for segments.
Other vulnerabilities in mooncake
See all- CVE-2026-96764Medium
A vulnerability was found in kvcache-ai mooncake up to version 0.3.12/0.3.14-rc1 in the MasterService::GetReplicaListByRegex function. Performing a manipulation leads to allocation of resources. The attack may be performed remotely and the exploit has been made public.
- CVE-2026-96762High
A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1 in the UnmountSegment function of the RPC Path Handler component. Manipulation of the client_id/segment_id arguments causes authorization bypass. Remote exploitation is possible and the exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.