The vulnerability resides in the UnmountSegment function of the RPC Path Handler in kvcache-ai mooncake. By manipulating the client_id and segment_id arguments, an attacker can bypass authorization checks, allowing an unauthorized user to unmount data segments. This bypass is a form of improper authorization (CWE‑285) and can also lead to privilege escalation through information misuse (CWE‑639). The effect is that a remote attacker can perform actions normally reserved for privileged users, potentially causing data loss or disruption.

The flaw is present in kvcache-ai mooncake versions up to 0.3.12 and 0.3.13.post1. Any instance running a version in that range or older is potentially vulnerable.

The CVSS score of 6.9 indicates a moderate risk, yet remote exploitation is possible and the exploit has been publicly disclosed. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Given the remote nature of the attack, the likelihood of exploitation remains uncertain but the impact of bypassing segment control warrants prompt attention.