Login Request a demo
High severity · published Oct 6, 2026
CVE-2026-106038
Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs
8.2
CVSS
0.5%
EPSS
No
On KEV
Description
Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and request failures.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mooncake · kvcache-ai
through 0.3.13.post1 · source: vendor
Affected product
MO
Mooncake
kvcache-ai
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106038
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106038
issue-tracking
https://github.com/kvcache-ai/Mooncake/issues/4474
technical-description
https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L6416-L6478
product
https://github.com/kvcache-ai/Mooncake
third-party-advisory
https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-unauthenticated-object-deletion-via-remove-rpcs
More from Mooncake
9.8
CVE-2026-106037
Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service
9.8
CVE-2026-103764
Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport
9.4
CVE-2026-103765
Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server
8.2
CVE-2026-106040
Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC
7.5
CVE-2026-104433
Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString