Threats affecting pkg:pypi/kvcache-ai/mooncake

Mooncake versions up to 0.3.13.post1 have a missing authentication vulnerability in the HTTP metadata server's /metadata handler. This flaw allows unauthenticated attackers to read, overwrite, and delete critical transfer engine metadata keys. Exploitation can lead to poisoning of segment descriptors or redirection of KV cache transfers to attacker-controlled listeners, as well as potential server memory exhaustion.

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.