Mooncake Store REST service: Missing authentication allows unauthenticated access

Summary

The Store REST service of the Python mooncake wheel, up to and including 0.3.13.post1, binds to 0.0.0.0 and does not require authentication on any route. An unauthenticated remote attacker can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data including user prompts, inject or delete objects, and mount attacker-defined segments. No special conditions are needed beyond network reachability of the service port, which defaults to 8080.

Affected

• kvcache-ai Mooncake, versions 0 to 0.3.13.post1 (Store REST service in the Python mooncake wheel)

Fixed in

• Unknown. No patched release has been found.
• Open pull request #4477 adds optional bearer token authentication, but it is opt-in, not verified as merged or released, and the default behaviour remains unauthenticated.

Workaround

• No official workaround from the vendor.
• Do not expose the Store REST service to shared, routed or untrusted networks.
• Restrict the service port (default 8080) with host firewall rules or network ACLs to the required clients only.
• Bind the service to localhost or a private interface where the deployment permits it.

Exploitation

• CISA SSVC: exploitation status PoC, automatable: yes, technical impact: total.
• Not known to be exploited (not in CISA KEV according to the sources checked).
• No public exploit confirmed; the GitHub issue #4476 is a detailed bug report.
• EPSS 0.00704 (low).

Our recommendation

• Inventory all Mooncake installations, including the Python wheel and the mc_store_rest_server console script.
• If found, block the REST port from all untrusted networks immediately.
• Check whether the REST server is running and whether it is reachable from other hosts.
• Track GitHub issue #4476 and pull request #4477 and do not assume a patch exists until a fixed release is published.
• Likelihood is low for most SMEs, but the impact is high where cached prompts may contain confidential business data.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Mooncake GitHub repository github.com
• GitHub issue #4476 github.com
• VulnCheck advisory www.vulncheck.com
• Pull request #4477 (optional bearer token auth) github.com
• Affected source file at commit 719735896c github.com
• VulDB entry 414297 vuldb.com
• Strix CVE details www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:16.