Log in Start free

Vulnerability · Published Sep 23, 2026 · Assigned by VulDB

CVE-2026-96762kvcache-ai mooncake RPC Path UnmountSegment authorization

High 7.3

In plain English

A high-severity authorization bypass via user-controlled key in mooncake from kvcache-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 78.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
kvcache-ai mooncake 0.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.7

Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References