A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. (CVE-2026-96762)
CVE-2026-96762 is a vulnerability in kvcache-ai mooncake up to versions 0.3.12 and 0.3.13.post1 affecting the UnmountSegment function of the RPC Path Handler component. The vulnerability allows manipulation of the client_id and segment_id arguments to bypass authorization. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor was contacted but did not respond or provide a fix. The CVSS score is 7.3, indicating a medium severity level.
AI Analysis
Technical Summary
The vulnerability in kvcache-ai mooncake (versions up to 0.3.12 and 0.3.13.post1) resides in the UnmountSegment function of the RPC Path Handler component. By manipulating the client_id and segment_id arguments, an attacker can bypass authorization controls. This flaw allows remote attackers to potentially perform unauthorized actions. The vulnerability is tracked as CVE-2026-96762 with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The vendor was notified early but has not responded or issued a patch. Public exploit code is available, though no known exploitation in the wild has been confirmed.
Potential Impact
The vulnerability enables remote attackers to bypass authorization checks in the UnmountSegment function, potentially leading to unauthorized access and modification of resources. Confidentiality, integrity, and availability impacts are rated low to medium based on the CVSS vector. The presence of public exploit code increases the risk of exploitation despite no confirmed active attacks in the wild.
Mitigation Recommendations
No official fix or patch is currently available as the vendor has not responded to disclosure. Users should apply strict access controls and monitor for suspicious RPC calls related to UnmountSegment. Consider isolating or restricting access to affected versions of kvcache-ai mooncake until a vendor patch or workaround is provided. Stay updated with vendor communications for any future remediation.
A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. (CVE-2026-96762)
Description
CVE-2026-96762 is a vulnerability in kvcache-ai mooncake up to versions 0.3.12 and 0.3.13.post1 affecting the UnmountSegment function of the RPC Path Handler component. The vulnerability allows manipulation of the client_id and segment_id arguments to bypass authorization. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor was contacted but did not respond or provide a fix. The CVSS score is 7.3, indicating a medium severity level.
CVSS v3.1
Score 7.3high
Affected software
pkg:pypi/kvcache-ai-mooncakeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in kvcache-ai mooncake (versions up to 0.3.12 and 0.3.13.post1) resides in the UnmountSegment function of the RPC Path Handler component. By manipulating the client_id and segment_id arguments, an attacker can bypass authorization controls. This flaw allows remote attackers to potentially perform unauthorized actions. The vulnerability is tracked as CVE-2026-96762 with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The vendor was notified early but has not responded or issued a patch. Public exploit code is available, though no known exploitation in the wild has been confirmed.
Potential Impact
The vulnerability enables remote attackers to bypass authorization checks in the UnmountSegment function, potentially leading to unauthorized access and modification of resources. Confidentiality, integrity, and availability impacts are rated low to medium based on the CVSS vector. The presence of public exploit code increases the risk of exploitation despite no confirmed active attacks in the wild.
Mitigation Recommendations
No official fix or patch is currently available as the vendor has not responded to disclosure. Users should apply strict access controls and monitor for suspicious RPC calls related to UnmountSegment. Consider isolating or restricting access to affected versions of kvcache-ai mooncake until a vendor patch or workaround is provided. Stay updated with vendor communications for any future remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5j6m-8f83-35hj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-96762"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab4be1df7a7c54106eee6c2
Added to database: 09/24/2026, 06:07:25 UTC
Last enriched: 09/24/2026, 06:17:08 UTC
Last updated: 09/25/2026, 02:47:33 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.