CVE-2026-96762 in mooncake
Summary
by MITRE • 09/24/2026
A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within kvcache-ai mooncake, specifically affecting versions up to 0.3.12 and 0.3.13.post1, represents a critical security flaw located in the RPC Path Handler component. This software is designed for managing key-value cache segments, often utilized in high-performance computing or large language model inference scenarios where efficient memory management of context windows is paramount. The core issue resides within the UnmountSegment function, which is responsible for handling requests to detach or unmount specific cache segments from active sessions. In a properly secured system, this operation must strictly validate that the requesting client possesses the necessary permissions to manipulate the specified segment. However, due to insufficient input validation and authorization checks, an attacker can exploit this weakness by manipulating the arguments passed during the RPC call, specifically targeting the client_id and segment_id parameters.
This flaw is classified as a Broken Access Control vulnerability, aligning with CWE-284 in the Common Weakness Enumeration taxonomy. The technical mechanism of the attack involves sending crafted requests where the attacker provides arbitrary or mismatched identifiers for the client and segment. Because the UnmountSegment function fails to verify that the authenticated user associated with the provided client_id actually owns or has permission to access the target segment identified by segment_id, it proceeds with the unmount operation regardless of authorization status. This logic error effectively bypasses the intended security controls, allowing unauthorized entities to perform administrative actions on resources they do not own. The absence of robust identity verification at this specific function level creates a direct path for privilege escalation or resource disruption within the application layer.
The operational impact of this vulnerability is severe due to its remote exploitable nature and public disclosure status. Since the RPC interface is typically exposed over network boundaries, an unauthenticated attacker can remotely trigger this flaw without prior authentication in many configurations, although some setups may require initial access depending on deployment specifics. The ability to forcibly unmount segments belonging to other users or system processes can lead to denial of service conditions by disrupting ongoing inference tasks for legitimate users. Furthermore, if the underlying implementation allows subsequent operations based on stale references after an unauthorized unmount, it could potentially lead to data leakage or corruption. The public availability of exploit code significantly lowers the barrier to entry for malicious actors, increasing the likelihood of active exploitation in vulnerable environments that have not yet applied mitigations.
From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK techniques related to Privilege Escalation and Defense Evasion, specifically leveraging API manipulation to bypass access controls. The fact that the vendor was contacted early but failed to respond indicates a gap in their security incident response process, leaving users exposed for an extended period after disclosure. This lack of timely patching or advisory release forces system administrators to rely on alternative mitigation strategies until official updates are provided. Organizations running affected versions must treat this as a high-severity issue requiring immediate attention due to the ease of exploitation and the critical nature of cache integrity in AI workloads.
To mitigate this risk, organizations should immediately isolate vulnerable instances from untrusted networks if possible. Implementing strict network segmentation ensures that only authorized internal services can communicate with the RPC endpoints hosting the mooncake component. Additionally, deploying a Web Application Firewall or API gateway with rigorous input validation rules can help detect and block malformed requests containing suspicious client_id or segment_id patterns before they reach the application logic. Until an official patch is released by kvcache-ai, administrators should consider upgrading to newer versions if available in later releases that may have addressed this flaw, or alternatively, disabling remote RPC access entirely for non-critical environments. Continuous monitoring of logs for unusual unmount operations and implementing strict rate limiting on the RPC interface can also reduce the blast radius of potential exploitation attempts.