Mooncake Store CVE-2026-106040

Exploitation requires network reachability to the Mooncake Store master's coro_rpc port; any attacker who can send RPCs to that port can invoke EvictDiskReplica/BatchEvictDiskReplica with no credentials (PR:N, no authorization check). The primary limiting factor is network exposure - deployments that bind the master RPC port to localhost or an isolated internal network segment, or place it behind network ACLs, are not remotely exploitable. The worst-case impact (permanent data loss) is conditioned on the targeted object having its only remaining replica on disk; objects with surviving in-memory or redundant replicas suffer availability degradation rather than total loss. Affected versions are Mooncake Store master through 0.3.13.post1.

This is a genuine high-priority issue for the environments that run it, though the signals point to destructive rather than confidentiality impact. The only CVSS data provided is a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H...), which describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, high availability impact (VA:H), low integrity impact (VI:L), and no confidentiality impact (VC:N) - fully consistent with the description of an unauthenticated actor erasing disk replicas via the EvictDiskReplica/BatchEvictDiskReplica RPCs. The CWE-862 (Missing Authorization) classification and the description agree with the vector, so there is no signal conflict on the technical mechanics. However, several decision-support signals are absent: no EPSS score, no SSVC decision, and no CISA KEV listing were provided, so exploitation likelihood cannot be quantified. There is no public exploit identified at time of analysis - the references include source code and a VulnCheck advisory but no weaponized POC. The practical risk is gated almost entirely by network exposure of the coro_rpc master port: if that port is reachable by an attacker, exploitation is trivial and the consequence (irreversible deletion of objects whose only replica lives on disk, across all tenants) is severe, so this should be treated as a real priority for exposed deployments rather than a high-CVSS-but-low-real-risk issue. The mislabel to note: impact is availability/data-loss driven, not a classic confidentiality breach, so prioritize it as a destructive/integrity-of-service risk.

An attacker with network access to the Mooncake Store master's coro_rpc port sends crafted EvictDiskReplica or BatchEvictDiskReplica RPC calls without any authentication, because the master performs no authorization check on these operations. By evicting DISK replicas across all tenants, the attacker permanently deletes cached objects whose only remaining copy is on disk, causing cross-tenant data loss. No public exploit code has been identified, but the attack requires only low complexity and reachability to the RPC port.