Mooncake Store CVE-2026-106039

Exploitation requires network reachability to the Mooncake Store master service's coro_rpc RPC port; no authentication, credentials, or user interaction are needed (PR:N/UI:N), and the victim client UUIDs required to target specific task queues are not a prerequisite the attacker must obtain externally because the unauthenticated QueryTask RPC discloses them directly. The practical limiting factor is network exposure of the coro_rpc port: if the master binds only to localhost or the port sits behind a firewall/trusted-network boundary, remote exploitation is blocked. Affected deployments are Mooncake Store master builds through 0.3.13.post1.

This is a medium-severity (CVSS 4.0 base 6.9) missing-authorization flaw (CWE-862) whose exploitability signals are favorable to an attacker but whose impact is bounded. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates fully remote, unauthenticated, low-complexity access with no user interaction - the hardest preconditions are already removed - and the design is self-enabling because the UUIDs needed to target victims are themselves disclosed by the unauthenticated QueryTask RPC. However, impact is explicitly limited to low integrity and low availability (VI:L/VA:L) with no confidentiality, no scope change, and no subsequent-system impact, so this is tampering with/hijacking of replication-task state rather than code execution or data theft. No EPSS score, CISA KEV listing, or POC indicator is present in the input, so there is no evidence of active exploitation or weaponization; the only exploitation enabler is the low barrier inherent to the design. Net: a genuine, credible issue for anyone exposing the Mooncake Store master's coro_rpc port to untrusted networks, but not a drop-everything emergency absent exposure - the real priority hinges on whether that port is network-reachable, which the CVE data does not state. One caveat: the input Tags label this 'Authentication Bypass' while the CWE and description describe missing authorization on already-reachable RPCs - a related but distinct class - verify framing against the VulnCheck advisory.

An attacker with network reachability to a Mooncake Store master's coro_rpc port calls QueryTask (no authentication) to enumerate active replication tasks and harvest legitimate client UUIDs, then replays those UUIDs into CreateCopyTask/CreateMoveTask, FetchTasks, and MarkTaskToComplete to hijack victim task queues and mark replications as complete that never actually ran. No public exploit was identified at time of analysis, but the attack requires only crafted RPC calls against the exposed port and no special tooling given the low attack complexity (AC:L).