Threats affecting pkg:pypi/kvcache-ai-mooncake

CVE-2026-96762 is a vulnerability in kvcache-ai mooncake up to versions 0.3.12 and 0.3.13.post1 affecting the UnmountSegment function of the RPC Path Handler component. The vulnerability allows manipulation of the client_id and segment_id arguments to bypass authorization. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor was contacted but did not respond or provide a fix. The CVSS score is 7.3, indicating a medium severity level.