{"id":"CVE-2026-106040","published":"2026-10-06T14:17:43.833","lastModified":"2026-10-06T20:17:16.960","description":"Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kvcache-ai/Mooncake","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L5507-L5515","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4478","tags":[]},{"url":"https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-missing-authorization-via-evictdiskreplica-rpc","tags":[]}],"exploitRefs":[{"url":"https://github.com/kvcache-ai/Mooncake","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L5507-L5515","tags":[]},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4478","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows unauthenticated attackers to delete disk replicas of objects across all tenants by exploiting missing authorization controls in the EvictDiskReplica and BatchEvictDiskReplica functions. This means attackers can permanently delete critical data without needing any authentication or privileges.","exploitability":"The exploit is relatively straightforward as attackers only need to reach the coro_rpc master port and send specific RPC requests, with no additional authentication requirements or complex preconditions needed.","blast_radius":"The impact could be severe as attackers can delete disk replicas for objects across all tenants, potentially leading to permanent data loss for multiple customers in a shared infrastructure environment.","remediation":"Restrict network access to the coro_rpc master port and implement proper authorization controls for EvictDiskReplica and BatchEvictDiskReplica endpoints.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["data-loss","authorization","rpc"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:57:03.381Z"}}