Vulnerabilidades do Kvcache-ai Mooncake

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Kvcache-ai Mooncake: 6 registro(s), com versões afetadas e correções.

CVE-2026-106041 Média · 6.5 CWE-862 06/10/2026

Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL_DISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replicas pointing at attacker-controlled endpoints to serve poisoned disk-tier reads and fake key existence.

CVE-2026-106040 Alta · 8.2 CWE-862 06/10/2026

Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk.

CVE-2026-106039 Média · 6.5 CWE-862 06/10/2026

Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.

CVE-2026-106038 Alta · 8.2 CWE-306 06/10/2026

Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and request failures.

CVE-2026-106037 Crítica · 9.8 CWE-306 06/10/2026

Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user prompts, inject or delete objects, and mount attacker-described segments.

CVE-2026-104433 Alta · 7.5 CWE-125 02/10/2026

Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference server.