CVE-2026-106038
Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs
- State
- Published
- Severity
- 8.8 High
- Published
- Oct 6, 2026
- Updated
- Oct 9, 2026
- Reserved
- Oct 6, 2026
Description
Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and request failures.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
Mooncakekvcache-ai |
|
References
- GitHub Issue #4474issue-tracking
- https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L6416-L6478technical-description
- https://github.com/kvcache-ai/Mooncakeproduct
- VulnCheck Advisory: Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.