{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-103765/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mooncake:mooncake:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.4,"id":"CVE-2026-103765"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mooncake (\u003c= 0.3.13.post1)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","authentication-bypass","cve-2026-103765"],"_cs_type":"advisory","_cs_vendors":["Mooncake"],"content_html":"\u003cp\u003eMooncake through version 0.3.13.post1 contains a critical missing authentication vulnerability in its HTTP metadata server, specifically within the /metadata handler. This vulnerability allows an unauthenticated, remote attacker to perform unauthorized read, overwrite, and delete operations on sensitive transfer engine metadata keys.\u003c/p\u003e\n\u003cp\u003eThe flaw is significant because it allows attackers to poison segment descriptors, such as the 'tcp_data_port' key, or re-create 'rpc_meta' entries. By manipulating these metadata keys, an attacker can effectively redirect KV cache transfers to attacker-controlled listeners, leading to potential data interception. Furthermore, the ability to overwrite or delete metadata keys can be leveraged to exhaust server memory, resulting in a denial-of-service condition. Given the nature of the application, this flaw poses a high risk to data integrity and availability for deployments utilizing the Mooncake transfer engine.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to intercept data transfers by redirecting KV cache traffic or crash the service by exhausting system memory. The vulnerability affects all Mooncake deployments using versions up to 0.3.13.post1.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to the latest version of Mooncake (beyond 0.3.13.post1) immediately upon the vendor release of a security patch.\u003c/li\u003e\n\u003cli\u003eImplement network-level access controls to restrict access to the Mooncake HTTP metadata server port to trusted administrative subnets only.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for unauthorized HTTP requests to the /metadata endpoint, specifically those utilizing PUT, POST, or DELETE methods from unexpected IP addresses.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-02T00:19:42Z","date_published":"2026-10-02T00:19:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mooncake-auth-bypass-1e18b12a/","summary":"Mooncake versions through 0.3.13.post1 contain an authentication bypass in the HTTP metadata server, allowing unauthenticated attackers to manipulate transfer engine keys, redirect data, or trigger denial-of-service.","title":"Authentication Bypass in Mooncake Metadata Server","url":"https://feed.craftedsignal.io/briefs/2026-10-mooncake-auth-bypass-1e18b12a/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-103765","version":"https://jsonfeed.org/version/1.1"}