Threat database

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL_DISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replicas pointing at attacker-controlled endpoints to serve poisoned disk-tier reads and fake key existence.

Mooncake Store versions up to 0.3.13.post1 have a missing authorization vulnerability that allows unauthenticated attackers to delete disk replicas of objects. This can be exploited via the EvictDiskReplica and BatchEvictDiskReplica functions by accessing the coro_rpc master port, potentially deleting objects whose only remaining replica is on disk.

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.

Mooncake Store versions up to 0.3.13.post1 have a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via specific functions on the coro_rpc port. This can lead to cache loss and request failures.

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user prompts, inject or delete objects, and mount attacker-described segments.

Mooncake transfer engine versions before 0.3.12 contain an out-of-bounds read vulnerability in the readString function. This flaw allows unauthenticated attackers to crash the service by sending a zero-length handshake frame to the handshake port. The vulnerability affects versions prior to 0.3.12 and can be exploited remotely without authentication.

Mooncake versions up to 0.3.13.post1 have a missing authentication vulnerability in the HTTP metadata server's /metadata handler. This flaw allows unauthenticated attackers to read, overwrite, and delete critical transfer engine metadata keys. Exploitation can lead to poisoning of segment descriptors or redirection of KV cache transfers to attacker-controlled listeners, as well as potential server memory exhaustion.

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.

CVE-2026-103761 is a high-severity memory exhaustion vulnerability in the kvcache-ai Mooncake transfer engine version 0.3.13.post1 and earlier. It allows unauthenticated attackers to send large notify frames repeatedly to the handshake RPC port, causing unbounded memory growth and potential process termination by the out-of-memory killer.

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single listener thread in writeFully(), breaking all subsequent handshakes, metadata fetches, notify and probe requests.

A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component Regular Expression Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

ktransformers versions up to and including 0.6.3 contain an unauthenticated deserialization vulnerability in the SchedulerServer ZMQ ROUTER socket. This flaw allows remote attackers to send crafted pickle payloads that execute arbitrary shell commands as the server process. The vulnerability is critical with a CVSS 9.3 score and was fixed in a commit identified as def0f93.

KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with the privileges of the ktransformers process.