Kvcache-Ai Mooncake
13 CVEs affecting Kvcache-Ai Mooncake. Latest disclosed: 2026-10-06. Critical: 3, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-106037 | Critical | 9.8 | 2026-10-06 | Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any r… |
CVE-2026-103764 | Critical | 9.8 | 2026-10-02 | Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and… |
CVE-2026-103765 | Critical | 9.4 | 2026-10-02 | Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attacke… |
CVE-2026-106040 | High | 8.2 | 2026-10-06 | Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk repl… |
CVE-2026-106038 | High | 8.2 | 2026-10-06 | Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via… |
CVE-2026-104433 | High | 7.5 | 2026-10-03 | Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated… |
CVE-2026-103761 | High | 7.5 | 2026-10-01 | Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated att… |
CVE-2026-96762 | High | 7.3 | 2026-09-24 | A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. Th… |
CVE-2026-106041 | Medium | 6.5 | 2026-10-06 | Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL_DISK… |
CVE-2026-106039 | Medium | 6.5 | 2026-10-06 | Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely c… |
CVE-2026-103760 | Medium | 5.9 | 2026-10-01 | Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake da… |
CVE-2026-96763 | Medium | 5.4 | 2026-09-24 | A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegm… |
CVE-2026-96764 | Medium | 4.3 | 2026-09-24 | A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component R… |