CVE-2026-96763

kvcache-ai mooncake MountSegment Request Processing segment.cpp access control

State: Published
Severity: 5.3 Medium
Published: Sep 24, 2026
Updated: Sep 29, 2026
Reserved: Sep 23, 2026

Description

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	5.4 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.4 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-284 Improper Access Controls
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
mooncakekvcache-ai	0.3.0Affected 0.3.1Affected 0.3.2Affected 0.3.3Affected 0.3.4Affected 0.3.5Affected 0.3.6Affected 0.3.7Affected 0.3.8Affected 0.3.9Affected 0.3.10Affected 0.3.11Affected 0.3.12Affected 0.3.13.post1Affected 0.3.14-rc1Affected

References

VDB-409018 | kvcache-ai mooncake MountSegment Request Processing segment.cpp access controlvdb-entrytechnical-description
VDB-409018 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-96763 | CVE Analysis and Reportthird-party-advisory
Submit #904605 | kvcache-ai mooncake mooncake-transfer-engine==0.3.11.post1 Access Controlthird-party-advisory
https://gist.github.com/yyymk/fea24846dc31042cb472d7bd496a8438exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.