Mooncake Store CVE-2026-106041

No authentication or authorization is enforced on the NotifyOffloadSuccess RPC (CWE-862), so exploitation requires only network access to the Mooncake Store master service RPC endpoint on a vulnerable build (through 0.3.13.post1) in its default state - the PR:N/AC:L vector confirms no special configuration is needed. Concrete prerequisites the attacker must control: (1) network reachability to the master RPC listener, and (2) attacker-controlled storage endpoints to host the poisoned LOCAL_DISK replica data referenced by the injected replicas. Primary limiting factor is exposure: if the master RPC port is confined to a trusted internal inference-cluster network rather than internet-facing, the realistic attack surface is sharply reduced; impact is also inherently bounded to cache data poisoning and forged key existence (integrity/availability of cached reads), not confidentiality or host compromise.

The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N, base 6.9/Medium) describes a remote, low-complexity, unauthenticated attack (PR:N) requiring no user interaction, but with deliberately constrained impact: no confidentiality loss (VC:N) and only LOW integrity and availability impact (VI:L/VA:L). This is consistent with the description - the flaw lets an attacker poison disk-tier cache reads and forge key existence, i.e. a data-integrity problem in a cache tier, not full system compromise or data theft. No EPSS score, no CISA KEV entry, and no POC are present in the provided data, so there is no public exploit identified at time of analysis and no quantitative exploitation-probability signal to weigh; no SSVC decision was supplied either. Net assessment: the vulnerability is cheap and easy to trigger wherever the Mooncake master RPC is network-reachable, but its bounded impact (cache poisoning / fake key existence rather than RCE or data exfiltration) keeps it a moderate rather than top-tier priority. The practical risk is dominated by exposure - if the master RPC is only reachable on a trusted internal cluster network, real-world risk drops substantially below what the AV:N vector implies. Note: no fix/patched version is present in the provided references, so remediation state cannot be confirmed from this data.

An attacker with network reach to the Mooncake Store master service sends a crafted NotifyOffloadSuccess RPC without any authentication, mounting a LOCAL_DISK segment under a self-chosen client UUID and attaching replicas that point at attacker-controlled endpoints. Subsequent disk-tier reads for those keys return attacker-supplied (poisoned) data and the store falsely reports that attacker-chosen keys exist, corrupting the KV cache served to LLM inference clients. No public exploit identified at time of analysis; low attack complexity (AC:L) means a simple RPC client is sufficient once the endpoint is reachable.