Missing Authorization Vulnerability in Mooncake Store by kvcache-ai
CVE-2026-106041

6.9MEDIUM

Key Information:

Vendor

Kvcache-ai

Status
Mooncake
Vendor
CVE Published:
6 October 2026

What is CVE-2026-106041?

The Mooncake Store product version 0.3.13.post1 presents a security flaw categorized as a missing authorization vulnerability. This issue allows unauthorized actors to exploit the NotifyOffloadSuccess RPC mechanism, enabling them to inject LOCAL_DISK replicas using custom client UUIDs. Consequently, attackers can manipulate the system by attaching replicas that direct to their endpoints, potentially leading to distorted disk-tier reads and fake key existence, which compromises the integrity of the data managed by the application.

Affected Version(s)

Mooncake 0 <= 0.3.13.post1

References

https://github.com/kvcache-ai/Mooncake/issues/4479
issue-tracking
https://github.com/kvcache-ai/Mooncake/blob/719735896c86b...
technical-description
https://github.com/kvcache-ai/Mooncake
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mingkai Yu
Jiajia Liu
.