CVE-2026-106038

HIGH 8.2

Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

CVSS Score

8.2

EPSS Score

0.0%

EPSS Percentile

0th

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and request failures.

CWE	CWE-306
Vendor	kvcache-ai
Product	mooncake
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for kvcache-ai mooncake

Be the first to know when new high vulnerabilities affecting kvcache-ai mooncake are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Affected Versions

kvcache-ai / Mooncake

0 ≤ 0.3.13.post1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/kvcache-ai/Mooncake/issues/4474 github.com: https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L6416-L6478 github.com: https://github.com/kvcache-ai/Mooncake vulncheck.com: https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-unauthenticated-object-deletion-via-remove-rpcs

Credits

Mingkai Yu Jiajia Liu