{"id":"CVE-2026-106038","published":"2026-10-06T14:17:42.420","lastModified":"2026-10-09T02:16:57.053","description":"Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and request failures.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kvcache-ai/Mooncake","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L6416-L6478","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4474","tags":[]},{"url":"https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-unauthenticated-object-deletion-via-remove-rpcs","tags":[]}],"exploitRefs":[{"url":"https://github.com/kvcache-ai/Mooncake","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L6416-L6478","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4474","tags":[]}],"hasPoc":true,"ai":{"summary":"The Mooncake Store application has a critical authentication bypass flaw that allows unauthenticated attackers to completely wipe the cache store by forcing deletion of any objects, potentially causing widespread service disruption and data loss.","exploitability":"Exploitation is straightforward requiring only network access to the coro_rpc port with no authentication prerequisites, making it highly practical for attackers to execute.","blast_radius":"If exploited, this vulnerability could cause complete cache corruption across the system, leading to widespread service failures and potential data unavailability as attackers can remove all cached data or specific key patterns.","remediation":"Disable the coro_rpc port or implement mandatory authentication for Remove, RemoveByRegex, RemoveAll and BatchRemove operations immediately, as no fixed version is published for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","cache","remote"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:57:09.127Z"}}