Medium severity · published Sep 24, 2026
CVE-2026-96763
kvcache-ai mooncake MountSegment Request Processing segment.cpp access control
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
mooncake · kvcache-ai
0.3.0; 0.3.1; 0.3.2; 0.3.3; 0.3.4; 0.3.5; +9 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-96763
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-96763
vdb-entry
https://vuldb.com/vuln/409018
signature
https://vuldb.com/vuln/409018/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-96763
third-party-advisory
https://vuldb.com/submit/904605
exploit
https://gist.github.com/yyymk/fea24846dc31042cb472d7bd496a8438
More from mooncake
9.8
CVE-2026-106037
Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service
9.8
CVE-2026-103764
Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport
9.4
CVE-2026-103765
Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server
8.2
CVE-2026-106040
Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC
8.2
CVE-2026-106038
Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs