CVE-2026-106037: Mooncake Store REST Service Missing Authentication
Mooncake through 0.3.13.post1 has a missing authentication flaw (CWE-306) in its Store REST service, which binds to 0.0.0.0 without authentication on any route. VulnCheck assigns a CVSS base score of 9.8, and the record lists no fixed version. The sources consulted show no confirmed exploitation in the wild, but operators should restrict network exposure and add authentication until an official fix is confirmed.
Overview
Mooncake through 0.3.13.post1 exposes its Store REST service on 0.0.0.0 without requiring authentication on any route. The weakness is classified as CWE-306, missing authentication for a critical function. The description in the record states that unauthenticated callers can reach several routes that read, write, delete and mount cached data.
Impact
- Confidentiality: the record states that cached KV data, including user prompts, can be read.
- Integrity: the record states that objects can be injected or deleted and that attacker-described segments can be mounted.
- Availability: the VulnCheck score of 9.8 reflects high impact ratings across confidentiality, integrity and availability.
Affected products and versions
- Kvcache-ai Mooncake through 0.3.13.post1, as listed in the record.
- The bind address 0.0.0.0 means the service listens on all network interfaces unless restricted by configuration or host firewall rules.
- Whether later releases are affected is unknown from the record.
Exploitation status
CISA KEV does not list this CVE, so no active exploitation is confirmed by that source. No confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field in the record is set to proof of concept, and the record marks the issue as automatable.
Remediation and mitigation
- No fixed version is listed in the record. The absence of a fix in the record does not prove that none exists, so check the project repository and the issue tracker for updates.
- Until an official fix is confirmed, restrict network access to the Store REST service with host and network firewalls, and bind it only to trusted interfaces.
- Place the service behind an authenticated gateway or limit it to trusted internal clients.
- Review whether the service is reachable from untrusted networks, including cloud and container environments.
Detection guidance
- Inventory hosts running Mooncake through 0.3.13.post1 and identify those where the Store REST service listens on all interfaces.
- Review network logs for unexpected inbound connections to the service port from sources that should not use it.
- Monitor for unexpected changes to cached objects or mounted segments as a sign of misuse.
Limitations of the available information
- The record does not list a fixed version, so remediation status is unknown.
- The record does not state whether the issue has been exploited, beyond the absence of a KEV listing.
- The source status is Deferred, so the details may change as the record is reviewed.
- Details of the vulnerable code are given in a technical description and the VulnCheck advisory.
Frequently asked questions
What is the core problem in this CVE?
The Store REST service of Mooncake through 0.3.13.post1 binds to 0.0.0.0 and does not require authentication on any route, which is classified as CWE-306.
Is there a fixed version?
The record does not list any fixed version. This is unknown, so check the project repository and issue tracker for updates.
Is this CVE known to be exploited in the wild?
CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.