Missing Authentication Vulnerability in Mooncake Store REST Service

CVE-2026-106037

What is CVE-2026-106037?

Mooncake versions through 0.3.13.post1 are susceptible to a missing authentication issue in the Store REST service. This vulnerability allows attackers to access the service without any authentication, binding to the 0.0.0.0 IP address. Attackers can exploit this weakness to call various API routes, such as /api/get, /api/put, /api/remove_all, and /api/mount, enabling them to read cached key-value data, inject or delete objects, and create malicious segments. This poses a significant risk to the integrity and confidentiality of the data managed by the service.

References