kvcache-ai Mooncake EUVD-2026-85751

Exploitation requires network access to the mooncake store's RPC service endpoint (the RPC Path Handler exposing UnmountSegment) and knowledge or enumeration of a valid client_id/segment_id belonging to another client. Per the CVSS vector the attack is unauthenticated (PR:N) and needs no user interaction (UI:N), so the primary limiting factors are network exposure of the RPC port and whether the deployment runs an affected version (<=0.3.12 or 0.3.13.post1). There is no upstream fix, so the practical mitigation is restricting network access to the RPC endpoint (trusted-network/isolation) rather than patching.

This is a moderate-severity authorization flaw whose real-world priority is tempered by the affected product's limited deployment footprint. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, base 5.5) describes a network-reachable, low-complexity, unauthenticated attack with tri-partite LOW impact - no single high-impact consequence, consistent with a scoped disruption (unmounting another client's segment) rather than full compromise. The signal that elevates attention is a PUBLICLY DISCLOSED exploit (E:P in the 4.0 vector, plus a proof-of-concept gist reference), which lowers the barrier to opportunistic use. Countervailing signals: this is NOT in CISA KEV, there is no EPSS score in the input, and there is no evidence of active exploitation - POC availability is a distinct signal from in-the-wild use. CWE-285 (improper authorization) aligns with the description far better than the assigned 'Authentication Bypass' tag, which mislabels an authorization/ownership-check gap. Net: a real but bounded issue - worth patching promptly on any exposed mooncake instance because it is unauthenticated and remote with public POC, but the LOW impact metrics and niche footprint make it a targeted rather than mass-exploitation risk. Note: no fixed version is published because the vendor did not respond to disclosure, so remediation currently depends on network isolation rather than an upstream patch.

An attacker with network reach to a mooncake store's RPC endpoint sends an UnmountSegment request supplying a client_id/segment_id that belongs to another tenant, and the handler unmounts it without verifying ownership - disrupting that client's KV cache state. Because the RPC path performs no authentication (PR:N) and the operation is low-complexity, the request can be scripted directly against the exposed port. A public proof-of-concept has been disclosed (gist), so no original exploit development is required.