EUVD-2026-85752
GHSA-c29f-6gh6-wwv9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Mooncake RPC endpoint over network
-
DeliveryCraft malicious MountSegment request
-
ExploitBypass ScopedSegmentAccess authorization check
-
ExecutionMount/register unauthorized segment
-
ImpactDisrupt integrity/availability for other clients
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to a running kvcache-ai Mooncake node (version 0.3.12/0.3.13.post1/0.3.14-rc1 or earlier) exposing the MountSegment RPC of the segment store, typically in a multi-client/multi-tenant LLM-serving deployment where segment mounting is used. No authentication is required per PR:N, and no special product configuration is named in the description. The vendor-assigned UI:P implies some passive user interaction may be a limiting factor, but this is unverified and inconsistent with the closely related UnmountSegment CVE (UI:N); impact is bounded to integrity/availability disruption of segment state with no confidentiality exposure and no code execution. No patched version exists, so the only mitigation is network isolation of the RPC surface. |
| Impact | This is a moderate-severity access-control flaw that is a real but limited concern. VulDB's CVSS 4.0 vector (5.3, AV:N/AC:L/AT:N/PR:N/UI:P) indicates a remote, low-complexity, unauthenticated flaw whose only friction is UI:P (passive user interaction) and whose impact is limited to low integrity and low availability (VC:N/VI:L/VA:L) - no confidentiality loss. The exploitation-maturity flag E:P plus the confirmed public POC gist means working exploit code exists, but there is NO CISA KEV entry and NO EPSS score in the input, so there is no evidence of active or widespread exploitation - status is publicly available exploit code, not confirmed exploitation. I question the vendor's UI:P: an improper access-control flaw in an RPC MountSegment request handler is normally triggered directly by the attacker's own request and needs no victim interaction - the sibling CVE-2026-96762 (UnmountSegment) carries UI:N. If UI:P is inaccurate, real-world risk is marginally higher than the 5.3 suggests. Net: a genuine authorization-bypass bug with a public POC but capped impact (no code execution, no data disclosure) in a niche LLM-serving component - prioritize for anyone actually running Mooncake, but it is not an internet-wide emergency. |
| Exploit ScenarioDerived | An attacker with network reach to a Mooncake master/store node sends a crafted MountSegment RPC that the ScopedSegmentAccess::MountSegment path fails to authorize, allowing them to mount or register segment metadata they should not control. This can corrupt the shared segment view used by other tenant clients, degrading integrity and availability of the KV-cache store. A public proof-of-concept exists (gist by yyymk), lowering the skill barrier to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Improper access control in kvcache-ai Mooncake up to versions 0.3.12, 0.3.13.post1, and 0.3.14-rc1 allows remote attackers to manipulate the ScopedSegmentAccess::MountSegment routine in segment.cpp so that a client can mount segments outside its intended scope, degrading the integrity and availability of segment state. Per the CVSS vector (PR:N) the attack requires no authentication, and impact is bounded to low integrity and availability loss with no confidentiality exposure and no code execution. Publicly available exploit code exists (a public gist is cited in the disclosure), and because the vendor was contacted early but did not respond, no vendor-released patch has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis: the reporter states the vendor was contacted early and did not respond, and none of the supplied references (https://vuldb.com/vuln/409018, https://vuldb.com/cve/CVE-2026-96763) points to a fixed version, so upgrading alone cannot be recommended as a fix. Until a patched release appears, treat the MountSegment RPC as an untrusted interface and isolate it: bind the segment-store RPC to a management network or loopback and firewall it so that only known client nodes can reach the service port, accepting the trade-off that any new or dynamically scaled worker must be allow-listed before it can mount segments. Where the deployment already supports it, enable mutual TLS or token-based authentication on the RPC channel and run Mooncake in a single-tenant cluster rather than sharing a segment store across trust domains; this costs operational complexity and can break existing unauthenticated clients. Because a public proof-of-concept exists (https://gist.github.com/yyymk/fea24846dc31042cb472d7bd496a8438), also monitor and alert on unexpected MountSegment calls and on segment registrations originating from unknown peer addresses, and watch the upstream kvcache-ai project for a committed fix that can be backported if no tagged release is issued.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mooncake is the KV-cache-centric transfer/segment store that underpins disaggregated LLM serving, where clients register, mount and unmount memory segments over RPC so that cached KV blocks can be exchanged between prefill, decode and storage nodes. CVE-2026-96763 is an instance of CWE-284 (Improper Access Control): the MountSegment request handler in segment.cpp, reached through the ScopedSegmentAccess class, does not adequately enforce the scoping that should restrict which segments a given caller may mount. The affected component is the MountSegment Request Processing path of the segment store, exposed over the network (AV:N/AC:L) and, per the PR:N vector, reachable without credentials; the vendor-assigned CVSS 4.0 vector additionally flags UI:P and exploit maturity E:P (proof-of-concept code publicly available). Our independent assessment scores the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, i.e. a moderate access-control defect whose consequences are confined to manipulating segment state (unauthorized mounting) rather than reading data or running code. It is closely related to the UnmountSegment access-control issue in the same codebase, which shares the same trust boundary and has UI:N, so the UI:P rating in the vendor vector should be treated as unverified.
Know when Mooncake gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated RPC access-control bypass needs no user interaction (UI:N, contra vendor UI:P); impact limited to low integrity and availability of segment state, no confidentiality.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Related Vulnerabilities in kvcache-ai mooncake Access Control and DoS Flaws
View all 3Unauthenticated attackers with network reachability to the Mooncake transfer engine's TCP transport data port on release
Unauthenticated access to Mooncake's HTTP metadata server (all versions through 0.3.13.post1) lets any network-reachable
Unauthenticated memory exhaustion in the Mooncake transfer engine (all versions through 0.3.13.post1) allows any network
Denial of service in Mooncake Transfer Engine through 0.3.13.post1 allows unauthenticated remote attackers to permanentl
Exploit-DB