CVE-2026-96762
Received Received - Intake

Authorization Bypass in kvcache-ai mooncake via RPC Path Handler

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description
A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-96762
EUVD
EUVD-2026-85751

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kvcache-ai mooncake to 0.3.12|start_including=0.3.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96762 is an authorization bypass vulnerability in kvcache-ai mooncake up to version 0.3.12/0.3.13.post1. It affects the UnmountSegment function in the RPC Path Handler component. The flaw allows manipulation of client_id or segment_id arguments to bypass authorization checks, enabling unauthorized segment deletion.

Detection Guidance

To detect CVE-2026-96762, monitor for unauthorized segment deletions in the Mooncake Master service. Check logs for RPC calls to UnmountSegment with mismatched client_id and segment_id. Inspect network traffic for requests to the admin endpoint /get_segments_detail in versions 0.3.4 through 0.3.12.

Impact Analysis

An attacker could exploit this to delete segments belonging to other clients by providing a victim's segment ID and an attacker-controlled client ID. This may cause data loss, service degradation, or denial of service. The vulnerability is exacerbated by an unauthenticated admin HTTP endpoint exposing segment and client identifiers.

Compliance Impact

This vulnerability could lead to unauthorized data deletion or service disruption in multi-tenant environments, potentially violating GDPR's data integrity and availability requirements or HIPAA's access controls and integrity standards. Unauthenticated segment deletion may result in loss of critical data, affecting compliance with data protection and security regulations.

Mitigation Strategies

Upgrade to a patched version of Mooncake beyond 0.3.12. Implement ownership verification in UnmountSegment RPC calls. Restrict access to the admin HTTP endpoint /get_segments_detail. Apply fail-closed logic to CommitUnmountSegment and audit other lifecycle operations for similar issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96762. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart