Mooncake: Missing authentication in HTTP metadata server
Summary
Mooncake through 0.3.13.post1, an open-source KV cache transfer platform for LLM inference, has missing authentication in the /metadata handler of its HTTP metadata server. An unauthenticated attacker with network access to that server can read, overwrite and delete transfer engine metadata keys, redirect KV cache transfers to attacker-controlled listeners, or exhaust the server's memory. No credentials are required, so network reachability of the service is the decisive condition.
Affected
- kvcache-ai Mooncake 0 to 0.3.13.post1 (per CVE record)
- Vulnerable component: HTTP metadata server (mooncake-wheel, http_metadata_server.py)
Fixed in
Unknown. No fixed release is confirmed. PR #4472 (optional shared token plus request and store limits) was described as in review in issue #4626. Later PRs refer to it as in effect, but its merge status and the fixed version are not verified.
Workaround
- Restrict access to the HTTP metadata port and the handshake RPC port to trusted nodes, or place them on an isolated network segment.
- Bind the metadata server to 127.0.0.1 where possible.
- Where the patch is present, set a shared token on the server and on every engine.
- Use a trusted network or TLS termination, because HTTP does not protect credentials or metadata.
- Limit outbound connections from Mooncake hosts and monitor HTTP logs for /metadata requests.
Exploitation
- A proof of concept is published in issue #4444 (reported as runtime-confirmed on 0.3.11.post1; not independently reproduced for this entry).
- CISA SSVC assessment: exploitation PoC, automatable: yes, technical impact: total.
- Not listed in CISA KEV. No active exploitation reported.
Our recommendation
- Inventory systems for Mooncake, for example with pip show mooncake-transfer-engine.
- If it is present, verify that the metadata port is not reachable from user or internet segments, and restrict it to trusted nodes.
- Treat as high priority only where the service is exposed. Update to a release that includes the fix once the fixed version is confirmed.
- Monitor logs for unexpected /metadata requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-103765 Mooncake Issue #4444 github.com
- VulnCheck advisory: Mooncake missing authentication in HTTP metadata server www.vulncheck.com
- Mooncake Issue #4626 github.com
- Mooncake PR #4472 github.com
- Mooncake PR #5071 github.com
- Vulnerable code: http_metadata_server.py github.com
- The Hacker Wire: CVE-2026-103765 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:53.
Original description (NVD)
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcp_data_port or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.
NVD references (5)
- https://github.com/kvcache-ai/Mooncake
- https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-wheel/mooncake/…
- https://github.com/kvcache-ai/Mooncake/issues/4444
- https://www.vulncheck.com/advisories/mooncake-through-0.3.13-post1-missing-authentication-in-http-metadata-se…
- https://github.com/kvcache-ai/Mooncake/issues/4444
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.