Mooncake Store master through version 0.3.13.post1 allows an attacker who is not authenticated to delete any stored object by using the Remove family of RPC calls. The vulnerability is caused by a missing authentication check and a force flag that bypasses lease enforcement. As a result an attacker can destroy individual keys, wipe keys that match a regular expression, or clear the entire store, leading to loss of cached data and potential application failures.

The affected product is Mooncake Store from kvcache-ai. All releases up to and including 0.3.13.post1 are vulnerable. No other versions are indicated by the CVE data.

The CVSS score of 8.8 indicates high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at this time. The likely attack vector is network traffic on the coro_rpc port where unauthenticated Remove RPC requests can be sent. Attackers who can reach this port can craft requests with the force flag set to bypass lease checks and trigger destructive operations.