Description
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk.
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized deletion of disk replicas
Action: Patch Immediately
AI Analysis

Impact

A missing authorization check in Mooncake Store allows attackers to call the EvictDiskReplica and BatchEvictDiskReplica RPCs without credentials, removing disk replicas of any stored object across all tenants. If the only remaining replica of an object is on disk, the object can be permanently deleted, causing data loss and impacting availability. The vulnerability is based on CWE-862 (Missing Authorization).

Affected Systems

Installations of Mooncake Store version 0.3.13.post1 or earlier from the kvcache-ai vendor are susceptible. All tenants hosted on these instances can be affected.

Risk and Exploitability

The CVSS score of 8.8 classifies the flaw as high severity. No EPSS data is available and the vulnerability is not in the CISA KEV list, implying that widespread exploitation has not been reported yet, but the lack of authorization still offers an immediate data integrity risk. Attackers must reach the coro_rpc master port, a network vector that can be restricted by firewall rules.

Generated by OpenCVE AI on October 6, 2026 at 18:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a patch or upgrade to a Mooncake Store release where EvictDiskReplica authorization is enforced
  • Restrict access to the coro_rpc master port using firewalls or network segmentation so only trusted hosts can reach it
  • Enable and monitor logs for EvictDiskReplica RPC usage and generate alerts for unauthorized attempts

Generated by OpenCVE AI on October 6, 2026 at 18:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Kvcache-ai
Kvcache-ai mooncake
Vendors & Products Kvcache-ai
Kvcache-ai mooncake

Tue, 06 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk.
Title Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Kvcache-ai Mooncake
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-06T19:30:24.362Z

Reserved: 2026-10-06T13:53:18.034Z

Link: CVE-2026-106040

cve-icon Vulnrichment

Updated: 2026-10-06T19:27:51.615Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T14:17:43.833

Modified: 2026-10-06T20:17:16.960

Link: CVE-2026-106040

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T23:30:07Z

Weaknesses