kvcache-ai mooncake Access Control and DoS Flaws

Authorization bypass in kvcache-ai's Mooncake KV-cache store (versions through 0.3.12 and 0.3.13.post1) lets any client that can reach the RPC service call the UnmountSegment handler and tear down storage segments belonging to other clients by supplying their client_id and segment_id. The attack is unauthenticated and needs no user interaction according to the CVSS vector (PR:N/UI:N), so the practical gate is network exposure of the RPC endpoint plus the ability to know or enumerate valid identifiers; impact is limited to integrity and availability of the distributed cache (C:N/I:L/A:L under CVSS 3.1, base 5.5 in the published CVSS 4.0 score). Publicly available exploit code exists in the form of a disclosure gist, but there is no evidence of active exploitation (no CISA KEV listing), and the vendor was contacted without responding, so no fixed release has been identified.

Improper access control in kvcache-ai Mooncake up to versions 0.3.12, 0.3.13.post1, and 0.3.14-rc1 allows remote attackers to manipulate the ScopedSegmentAccess::MountSegment routine in segment.cpp so that a client can mount segments outside its intended scope, degrading the integrity and availability of segment state. Per the CVSS vector (PR:N) the attack requires no authentication, and impact is bounded to low integrity and availability loss with no confidentiality exposure and no code execution. Publicly available exploit code exists (a public gist is cited in the disclosure), and because the vendor was contacted early but did not respond, no vendor-released patch has been identified at time of analysis.

Uncontrolled resource allocation in the MasterService::GetReplicaListByRegex handler of kvcache-ai Mooncake (all versions up to and including 0.3.12, and 0.3.14-rc1) allows a remote low-privilege client that can reach the MasterService RPC endpoint to exhaust server memory or CPU by submitting a crafted regular expression to the Regular Expression Handler. The impact is availability-only and partial (CVSS 4.0 5.3, VA:L; assessed CVSS 3.1 5.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so this is a denial-of-service concern rather than a confidentiality or integrity compromise. Publicly available exploit code exists (a proof-of-concept gist is referenced via VulDB), and the affected project has a small deployment footprint; no CISA KEV entry exists and no vendor patch was released because the vendor did not respond to the disclosure.