Advisory · CVE-2026-106038
Unauthenticated requests can wipe Mooncake's distributed KV cache
Mooncake Store through 0.3.13.post1 exposes object-deletion RPCs without authentication, letting unauthenticated attackers delete arbitrary objects, wipe keys matching a regex, or clear the entire store, causing cache loss and request failures.
- Vendor
- kvcache-ai
- Product
- Mooncake
- Identifier / CWE
- CVE-2026-106038
CWE-306 - Action timing
- Immediate
Explain it like I’m five
Mooncake is a shared storage box that AI servers use to pass data around. Its delete buttons were left out in the open with no lock, so anyone on the network can walk up and empty the whole box, and every AI job depending on it breaks.
- 01Exposed RPC port
The Mooncake Store master service listens on its coro_rpc port, reachable from the network.
- 02No authentication
The Remove, RemoveByRegex, RemoveAll, and BatchRemove RPCs require no credentials.
- 03Forged request
An unauthenticated attacker sends forged requests with the force flag set, bypassing lease checks.
- 04Store wiped
Objects, regex-matched key ranges, or the entire store are deleted, causing cache loss and request failures.
What happened
Mooncake Store from master through 0.3.13.post1 contains a missing-authentication vulnerability in its distributed object store. The Remove, RemoveByRegex, RemoveAll, and BatchRemove RPCs on the coro_rpc port accept unauthenticated requests; sending a forged request with the force flag set bypasses lease checks, allowing an attacker to delete arbitrary objects, wipe every key matching a regex, or clear the entire store.
The flaw is rated high at CVSS 4.0 8.8 and tracked as CWE-306 (missing authentication for critical function). Mooncake is the transfer engine behind disaggregated LLM inference, so a wiped store translates directly into failed and stalled inference jobs.
What to do
- Restrict network access to the Mooncake Store master coro_rpc port immediately; it should not be reachable beyond trusted hosts.
- Upgrade to a release containing the upstream fix once available.
- Audit store contents and metadata for unexpected deletions or mass removals.
- Review network and service logs for unauthenticated calls to the Remove family of RPCs.
- Rebuild or repopulate the cache store from trusted sources if tampering cannot be excluded.
Management note
This is an unauthenticated, network-reachable path to destroying the shared state that AI inference pipelines depend on. Even where exploitation has not occurred, an exposed Mooncake master port is an unacceptable configuration; firewall it first and treat the upgrade as urgent.