CVE-2026-106039 in Mooncake
Summary
by MITRE • 10/06/2026
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Mooncake Store versions through 0.3.13.post1 represents a critical failure in access control mechanisms within the application's remote procedure call interface. Specifically, the flaw resides in the handling of requests sent over the coro_rpc port, where the system fails to verify whether the requesting entity possesses the necessary permissions to execute specific administrative or data-manipulation operations. This missing authorization defect allows unauthenticated actors to interact directly with internal service endpoints that should be restricted to authorized clients only. The core issue is not a failure in input validation or buffer management but rather a logical error where the server accepts and processes commands based solely on the presence of valid-looking parameters, such as client UUIDs, without confirming that the requester has been authenticated or granted explicit rights for those actions.
The operational impact of this vulnerability is severe due to the nature of the functions exposed by the coro_rpc interface. Attackers can exploit this lack of authentication to invoke methods including CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete. By supplying victim client UUIDs that are disclosed through the QueryTask endpoint, an attacker can hijack task queues belonging to legitimate users or systems. This capability enables the creation of replication tasks that do not correspond to actual data movements, effectively allowing the adversary to fabricate evidence of data synchronization. Furthermore, by marking these non-existent tasks as complete, attackers can manipulate system state and logs, potentially causing confusion in monitoring tools or triggering downstream processes that rely on accurate task completion status for critical operations such as disaster recovery or data consistency checks.
From a technical perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, specifically the failure to verify identity before granting access to resources. The ability to use disclosed UUIDs from QueryTask suggests that while some endpoints may be public or loosely secured, they inadvertently leak identifiers that facilitate further exploitation of more sensitive endpoints like CreateCopyTask and MarkTaskToComplete. This chain of events is characteristic of an attack pattern often seen in the MITRE ATT&CK framework under T1078, Valid Accounts, although here it involves hijacking task contexts rather than direct account takeover. The attacker leverages publicly accessible information to gain unauthorized control over internal workflows, which falls under techniques related to privilege escalation and resource manipulation within distributed storage systems.
The consequences of such exploitation extend beyond simple data theft or corruption. In a production environment relying on Mooncake Store for replication and data integrity, false completion records can lead to significant operational disruptions. Administrators might believe that critical backups have been successfully replicated when they have not, leading to potential data loss in the event of a primary system failure. Additionally, the creation of fake tasks consumes system resources and may interfere with legitimate task scheduling algorithms, potentially causing latency or failures for genuine replication jobs. This undermines the reliability guarantees provided by distributed storage architectures and compromises the trustworthiness of audit trails used for compliance and forensic analysis.
Mitigation strategies must focus on implementing robust authentication and authorization checks at the service layer before any business logic is executed. Developers should ensure that all RPC endpoints, particularly those modifying state or managing tasks, require valid session tokens or API keys that are verified against an identity provider. It is also advisable to implement strict input validation where client UUIDs provided in task creation requests must be validated not just for format but for ownership by the authenticated user making the request. Rate limiting and anomaly detection on the QueryTask endpoint can help mitigate the initial information disclosure, while comprehensive logging of all RPC invocations with source IP and authentication status will aid in detecting exploitation attempts. Upgrading to a patched version that addresses these authorization gaps is the primary remediation step for affected deployments.