High severity8.2NVD Advisory· Published Oct 6, 2026

CVE-2026-106040

Description

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Kvcache AI/kvcache-aillm-fuzzy
Range: <=0.3.13.post1

Patches

Vulnerability mechanics

References

github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cppnvd
github.com/kvcache-ai/Mooncake/issues/4478nvd
www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-missing-authorization-via-evictdiskreplica-rpcnvd

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000