CVE-2026-106039CWE-862broken-access-control

CVE-2026-106039

Medium · published October 6, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00332 · 25.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-06T18:17Z
References (6)
https://github.com/kvcache-ai/Mooncake · [email protected]https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L12060-L12120 · [email protected]https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/task_manager.cpp#L113-L135 · [email protected]https://github.com/kvcache-ai/Mooncake/issues/4475 · [email protected]https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-missing-authorization-in-replication-task-rpc · [email protected]https://github.com/kvcache-ai/Mooncake/issues/4475 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 06 OCT 14:03Z
    Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC
    cvelistv5