This vulnerability in kvcache-ai mooncake up to versions 0.3.12, 0.3.13.post1, and 0.3.14-rc1 affects the ScopedSegmentAccess::MountSegment function in the segment.cpp file. The flaw results in improper access controls when processing MountSegment requests, which can be exploited remotely. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and partial impact on confidentiality, integrity, and availability. Public exploit code has been released, but the vendor has not issued any advisory or patch.

The vulnerability allows remote attackers to bypass proper access controls in the MountSegment request processing, potentially leading to unauthorized access or manipulation of segments. The impact is rated medium based on CVSS 4.0 with partial confidentiality, integrity, and availability impacts. Exploit code is publicly available, increasing the risk of exploitation despite no known active exploitation in the wild.

No official patch or remediation is currently available, and the vendor has not responded to the disclosure. Users should monitor vendor channels for updates. Until a fix is released, consider restricting network access to affected services and applying compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.