Cpe:2.3:a:kvcache_ai:mooncake:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3akvcache_aimooncake/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 24 Sep 2026 00:45:44 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in kvcache-ai Mooncake RPC Path Handlerhttps://feed.craftedsignal.io/briefs/2026-09-mooncake-auth-bypass/Thu, 24 Sep 2026 00:45:44 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-mooncake-auth-bypass/An authorization bypass vulnerability in the UnmountSegment function of the kvcache-ai mooncake RPC Path Handler allows unauthenticated remote attackers to perform unauthorized operations by manipulating client_id or segment_id arguments.CVE-2026-96762 identifies an authorization bypass vulnerability affecting kvcache-ai mooncake versions up to and including 0.3.13.post1. The flaw exists within the UnmountSegment function of the RPC Path Handler component. Due to insufficient validation of input arguments, an attacker can manipulate the client_id or segment_id parameters during an RPC request to circumvent security controls. This vulnerability allows for remote exploitation, potentially enabling unauthorized access to or manipulation of cached segments. A proof-of-concept exploit has been publicly disclosed, increasing the risk of active exploitation. The vendor has not provided a response or a security patch as of the time of disclosure, leaving implementations of mooncake in the affected versions currently vulnerable to unauthorized administrative actions.

Impact

Successful exploitation of this vulnerability allows unauthorized remote actors to interact with the RPC Path Handler in unintended ways, potentially leading to unauthorized data modification or segment unmounting. This poses a significant risk to the integrity and availability of services relying on mooncake for caching. As public exploits are available, the probability of targeting by opportunistic attackers is elevated.

Recommendation

  • Monitor network traffic directed at the mooncake RPC endpoints for anomalous requests containing modified client_id or segment_id parameters.
  • Implement strict network segmentation to restrict access to the RPC interface to trusted internal systems only.
  • Given the lack of a vendor patch, evaluate the necessity of the mooncake service and consider isolating or disabling the service if it cannot be adequately protected behind authentication or network controls.
  • Audit access logs for the RPC Path Handler to identify any unusual UnmountSegment calls that deviate from standard service behavior.
]]>highthreatvulnerabilityremote-accessrpc