CVE-2026-106040: Kvcache-Ai Mooncake

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk.

Affected products

• Kvcache-Ai Mooncake: up to and including 0.3.13.post1

Published 2026-10-06. Last modified 2026-10-06.