CVE-2026-103765 in Mooncake
Summary
by MITRE • 10/02/2026
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcp_data_port or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Mooncake versions through 0.3.13.post1 represents a critical failure in access control mechanisms within the HTTP metadata server component. Specifically, the /metadata handler lacks proper authentication checks, allowing any network-accessible actor to interact with sensitive system data without providing valid credentials. This architectural flaw aligns closely with CWE-287, which describes Improper Authentication, and falls under MITRE ATT&CK technique T1078, Valid Accounts, as it allows unauthorized actors to leverage the service's functionality despite lacking legitimate identity verification. The absence of authentication on this endpoint creates a direct pathway for attackers to manipulate core operational parameters that govern how data is transferred between components in distributed systems utilizing Mooncake’s transfer engine.
The technical impact of this vulnerability is severe due to the nature of the metadata being exposed and modifiable. Attackers can read, overwrite, or delete transfer engine metadata keys, which are essential for coordinating high-performance data movement operations. By poisoning segment descriptors such as tcp_data_port, an attacker can redirect network traffic intended for legitimate services toward malicious listeners controlled by the adversary. This capability enables potential man-in-the-middle attacks where sensitive KV cache transfers, often containing critical model weights or inference results in large language model deployments, are intercepted and exfiltrated. Furthermore, attackers can re-create rpc_meta entries to hijack remote procedure call metadata, effectively taking control over how services communicate with one another within the cluster environment.
Beyond data interception, this vulnerability facilitates denial-of-service attacks through resource exhaustion. By manipulating metadata keys or creating excessive invalid entries, an attacker can force the server to allocate disproportionate amounts of memory processing these malformed requests. This leads to a degradation of service availability for legitimate users and potentially causes system crashes if the memory limits are exceeded. The combination of data confidentiality loss via KV cache redirection and system integrity compromise through resource exhaustion makes this a high-severity issue that threatens both the security posture and operational stability of Mooncake-based deployments.
Mitigation strategies must prioritize immediate remediation by upgrading to patched versions where authentication is enforced on all metadata endpoints. In environments where an upgrade is not immediately feasible, network-level controls should be implemented to restrict access to the HTTP metadata server exclusively from trusted internal subnets or specific service accounts using firewall rules or ingress controller policies. Additionally, implementing strict input validation and rate limiting on the /metadata handler can help mitigate the risk of resource exhaustion attacks while authentication mechanisms are being deployed. Regular security audits focusing on API endpoint authorization logic are recommended to prevent similar misconfigurations in distributed system components that handle critical operational metadata.