Missing Authorization Vulnerability in Mooncake Store by kvcache-ai
CVE-2026-106040

8.8HIGH

Key Information:

Vendor

Kvcache-ai

Status
Mooncake
Vendor
CVE Published:
6 October 2026

What is CVE-2026-106040?

The Mooncake Store, prior to version 0.3.13.post1, contains a significant vulnerability that allows unauthenticated attackers to delete any object's disk replicas through the EvictDiskReplica and BatchEvictDiskReplica features. By accessing the coro_rpc master port, these attackers can erase disk replicas across multiple tenants, jeopardizing the integrity and availability of essential data.

Affected Version(s)

Mooncake 0 <= 0.3.13.post1

References

https://github.com/kvcache-ai/Mooncake/issues/4478
issue-tracking
https://github.com/kvcache-ai/Mooncake/blob/719735896c86b...
technical-description
https://github.com/kvcache-ai/Mooncake
product

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mingkai Yu
Jiajia Liu
.