High severity · published Sep 23, 2026
CVE-2026-96762
kvcache-ai mooncake RPC Path UnmountSegment authorization
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
mooncake · kvcache-ai
0.3.0; 0.3.1; 0.3.2; 0.3.3; 0.3.4; 0.3.5; +8 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-96762
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-96762
gist.github.com
https://gist.github.com/yyymk/76d099537af0e661dd01eacc82b9a7ea
vuldb.com
https://vuldb.com/cve/CVE-2026-96762
vuldb.com
https://vuldb.com/submit/904600
vuldb.com
https://vuldb.com/vuln/409016
vuldb.com
https://vuldb.com/vuln/409016/cti
More from mooncake
9.8
CVE-2026-106037
Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service
9.8
CVE-2026-103764
Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport
9.4
CVE-2026-103765
Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server
8.2
CVE-2026-106040
Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC
8.2
CVE-2026-106038
Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs