Missing Authentication Vulnerability in Mooncake by kvcache-ai

CVE-2026-103765

What is CVE-2026-103765?

The Mooncake product by kvcache-ai, specifically versions 0.3.13.post1 and earlier, contains a significant vulnerability in its HTTP metadata server. This flaw allows unauthenticated attackers to exploit the /metadata handler, resulting in unauthorized reading, overwriting, and deletion of transfer engine metadata keys. By manipulating segment descriptors like tcp_data_port, attackers can redirect KV cache transfers to malicious listeners or even create excessive load on server memory, potentially leading to service disruptions.

References