Mooncake CVE-2026-103765

Exploitation requires network reachability to Mooncake's HTTP metadata server and its /metadata handler, which by design performs no authentication (CWE-306, PR:N) - any party that can connect can read, overwrite, or delete transfer-engine metadata keys. The practical limiting factor is network exposure, not an attacker prerequisite: the metadata server is meant to coordinate transfer engines inside an LLM serving cluster, so impact is realized only where that endpoint is reachable from an untrusted network rather than bound to a trusted internal backplane or localhost. To weaponize beyond pure DoS, the attacker must also be able to stand up a listener that the poisoned segment descriptor (tcp_data_port) or recreated rpc_meta entry will redirect KV cache transfers toward. Affected versions are Mooncake through 0.3.13.post1.

The input provides a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H) scoring 8.8, indicating a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and availability impact - consistent with CWE-306 (Missing Authentication for a Critical Function). All exploitation-barrier signals point the same direction: no authentication, no user interaction, and no special attack requirements, so the technical risk for any exposed instance is genuinely high rather than inflated. However, several key prioritization signals are ABSENT from the input: no EPSS probability was supplied, there is no CISA KEV listing, and no proof-of-concept is referenced, so real-world exploitation volume cannot be quantified from the data provided - this is a high-severity issue by construction but with no evidence of active or at-scale exploitation. No SSVC decision data was provided. The dominant mitigating factor is exposure scope rather than exploit difficulty: Mooncake's HTTP metadata server is intended for internal transfer-engine coordination within an LLM serving cluster, so risk hinges entirely on whether that endpoint is reachable from untrusted networks. Treat as high priority for any deployment where the metadata server is network-exposed, and as lower practical urgency where it is confined to a trusted backplane.

An attacker who can reach the Mooncake HTTP metadata server sends unauthenticated requests to the /metadata handler to overwrite a segment descriptor (e.g. tcp_data_port) or re-create an rpc_meta entry, redirecting KV cache transfers to an attacker-controlled listener to capture or disrupt in-flight inference data. Alternatively the attacker floods the handler with writes to exhaust server memory and cause denial of service. No public exploit is identified at time of analysis, but the vulnerable code path is pinpointed in the referenced source (http_metadata_server.py).