CVE-2026-96762CWE-285CWE-639

CVE-2026-96762

High · published September 24, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00292 · 20.6th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-24T04:17Z
References (5)
https://gist.github.com/yyymk/76d099537af0e661dd01eacc82b9a7ea · [email protected]https://vuldb.com/cve/CVE-2026-96762 · [email protected]https://vuldb.com/submit/904600 · [email protected]https://vuldb.com/vuln/409016 · [email protected]https://vuldb.com/vuln/409016/cti · [email protected]
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 23:45Z
    kvcache-ai mooncake RPC Path UnmountSegment authorization
    cvelistv5