CVE-2026-106037: Missing Authentication for Critical Function in kvcache-ai Mooncake

CVE-2026-106037 describes a missing authentication vulnerability in the kvcache-ai Mooncake product, specifically in its Store REST service. The service listens on 0.0.0.0 and does not enforce authentication on any route. This allows unauthenticated remote attackers to perform critical operations such as reading cached key-value data with user prompts, injecting or deleting objects, and mounting attacker-defined segments via API endpoints like /api/get, /api/put, /api/remove_all, and /api/mount. The vulnerability affects all versions up to and including 0.3.13.post1.

Unauthenticated attackers can remotely access and manipulate cached key-value data, potentially leading to data disclosure, data tampering, and unauthorized control over cache segments. This compromises the confidentiality, integrity, and availability of the affected service.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Store REST service to trusted hosts only and consider implementing external authentication or firewall rules to prevent unauthorized access.