Mooncake Store: Missing authentication allows unauthenticated object deletion
Summary
Mooncake Store master through 0.3.13.post1 does not require authentication on its coro_rpc port. An unauthenticated attacker can send forged Remove, RemoveByRegex, RemoveAll or BatchRemove requests, using the force flag to bypass lease checks, to delete any object, all keys matching a regex, or the entire store. This causes cache loss and request failures, and the CVSS 4.0 base score is 8.8 with no privileges or user interaction required when the port is reachable.
Affected
- kvcache-ai Mooncake Store (mooncake-store master) 0 to 0.3.13.post1, per the CVE record and the reporter
- Last affected commit per OSV: 719735896c86b56fabec6cf3e825fb2ea640597a
Fixed in
Unknown. No patched release or vendor security advisory was found at the time of research.
Workaround
- No vendor-endorsed workaround is known.
- Do not expose the master RPC port (default 0.0.0.0:50051) beyond the trusted cluster.
- Restrict the port with host firewall rules or network ACLs to known Mooncake clients.
- Keep the service off public and shared networks.
Exploitation
- Exploitation in the wild: nothing known; not listed in the CISA KEV catalog.
- CISA SSVC lists exploitation as 'poc' and the issue as automatable.
- A separate public proof-of-concept repository was not confirmed during research.
- EPSS is about 0.005, which is low.
Our recommendation
- Check whether Mooncake Store is deployed. If not, no action needed.
- If it is deployed, verify whether the master RPC port is reachable from untrusted networks and close that exposure first.
- Apply the workarounds above and monitor for unexpected Remove or clear calls.
- Track the upstream repository and upgrade as soon as a fixed release is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mooncake GitHub repository github.com
- Upstream issue #4474 github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-106038 osv.dev
- Vulners CVE record CVE-2026-106038 vulners.com
- VulDB entry 414294 vuldb.com
- Upstream pull request #4484 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:21.
Original description (NVD)
Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and request failures.
NVD references (4)
- https://github.com/kvcache-ai/Mooncake
- https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/maste…
- https://github.com/kvcache-ai/Mooncake/issues/4474
- https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-unauthenticated-object-deletion-via-…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.