CVE-2026-96763 - Vulnerability Details

- kvcache-ai mooncake MountSegment Request Processing segment.cpp access control

Description

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-09-24

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from an improper access control flaw in the MountSegment Request Processing component of kvcache-ai mooncake. Manipulating input to the ScopedSegmentAccess::MountSegment function allows an attacker to gain unauthorized access to protected segments, thereby compromising data confidentiality and potentially altering system state. The attack can be launched remotely, and a public exploit technique has already been released, indicating a real risk to systems that have not mitigated the issue.

Affected Systems

kvcache-ai mooncake versions up to and including 0.3.12, 0.3.13.post1, and 0.3.14-rc1 are affected. The flaw is present in the segment.cpp file within the MountSegment Request Processing module.

Risk and Exploitability

With a CVSS score of 5.3 the vulnerability presents a moderate severity rating. The EPSS score is not available and the version is not listed in the CISA KEV catalog, but the availability of a public exploit and the remote nature of the attack suggest a tangible risk. Systems with exposed MountSegment interfaces should consider the risk high enough to trigger mitigation procedures.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

kvcache-ai

mooncake

affected

Version	Status	Constraints
`0.3.0`	affected	—
`0.3.1`	affected	—
`0.3.2`	affected	—
`0.3.3`	affected	—
`0.3.4`	affected	—
`0.3.5`	affected	—
`0.3.6`	affected	—
`0.3.7`	affected	—
`0.3.8`	affected	—
`0.3.9`	affected	—
`0.3.10`	affected	—
`0.3.11`	affected	—
`0.3.12`	affected	—
`0.3.13.post1`	affected	—
`0.3.14-rc1`	affected	—

No data.

Vendor Product Confidence Versions

Kvcache-ai

Mooncake

100%

Version	Status	Scheme	Platform
`0.3.0`	affected	semver	—
`0.3.1`	affected	semver	—
`0.3.2`	affected	semver	—
`0.3.3`	affected	semver	—
`0.3.4`	affected	semver	—
`0.3.5`	affected	semver	—
`0.3.6`	affected	semver	—
`0.3.7`	affected	semver	—
`0.3.8`	affected	semver	—
`0.3.9`	affected	semver	—
`0.3.10`	affected	semver	—
`0.3.11`	affected	semver	—
`0.3.12`	affected	semver	—
`0.3.13.post1`	affected	generic	—
`0.3.14-rc1`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade mooncake to a patched release if one exists (e.g., any version newer than 0.3.14-rc1).
If an upgrade is not immediately possible, restrict external access to MountSegment endpoints using firewalls or network segmentation to prevent remote exploitation.
Add application‑level checks that enforce proper privilege levels before permitting segment mounts, ensuring that only authenticated and authorized users can perform this action.

Generated by OpenCVE AI on September 24, 2026 at 01:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00247.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://gist.github.com/yyymk/fea24846dc31042cb472d7bd496a8438
https://vuldb.com/cve/CVE-2026-96763
https://vuldb.com/submit/904605
https://vuldb.com/vuln/409018
https://vuldb.com/vuln/409018/cti

History

Thu, 24 Sep 2026 00:30:00 +0000

Type	Values Removed	Values Added
Description		A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title		kvcache-ai mooncake MountSegment Request Processing segment.cpp access control
First Time appeared		Kvcache-ai Kvcache-ai mooncake
Weaknesses		CWE-266 CWE-284
CPEs		cpe:2.3:a:kvcache-ai:mooncake::::::::
Vendors & Products		Kvcache-ai Kvcache-ai mooncake
References		https://gist.github.com/yyymk/fea24846dc31042cb472d7bd496a8438 https://vuldb.com/cve/CVE-2026-96763 https://vuldb.com/submit/904605 https://vuldb.com/vuln/409018 https://vuldb.com/vuln/409018/cti
Metrics		cvssV2_0 `{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Kvcache-ai Mooncake

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-24T00:00:16.519Z

Updated: 2026-09-24T00:00:16.519Z

Reserved: 2026-09-23T16:01:21.340Z

Link: CVE-2026-96763

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-09-24T01:16:59.627

Modified: 2026-09-24T14:40:36.103

Link: CVE-2026-96763

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-24T03:30:07Z

Weaknesses

CWE-266
Incorrect Privilege Assignment
CWE-284
Improper Access Control

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object