Vulnerability · Published Oct 6, 2026 · Assigned by VulnCheck

CVE-2026-106038Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

High 8.2

In plain English

A high-severity missing authentication in Mooncake from kvcache-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and request failures.

Affected products (as reported)

Vendor	Product	Versions
kvcache-ai	Mooncake	0 – through 0.3.13.post1

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References

GitHub Issue #4474 issue-tracking
https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L6416-L6478 technical-description
https://github.com/kvcache-ai/Mooncake product
VulnCheck Advisory: Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs third-party-advisory