Vulnerability · Published Oct 6, 2026 · Assigned by VulnCheck

CVE-2026-106039Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC

Medium 6.5

In plain English

A medium-severity missing authorization in Mooncake from kvcache-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 73.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.

Affected products (as reported)

Vendor	Product	Versions
kvcache-ai	Mooncake	0 – through 0.3.13.post1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

GitHub Issue #4475 issue-tracking
https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L12060-L12120 technical-description
https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/task_manager.cpp#L113-L135 technical-description
https://github.com/kvcache-ai/Mooncake product
VulnCheck Advisory: Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC third-party-advisory