CVE-2026-96763
Received Received - Intake

Improper Access Control in kvcache-ai mooncake

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description
A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-96763
EUVD
EUVD-2026-85752

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kvcache-ai mooncake to 0.3.14-rc1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in kvcache-ai mooncake versions up to 0.3.12/0.3.13.post1/0.3.14-rc1. It involves improper access controls in the MountSegment function of segment.cpp. An attacker can remotely manipulate the system to forge segment details without ownership validation, leading to memory corruption in victim clients.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized segment registrations or memory overwrites in kvcache-ai mooncake. Monitor the Master's HTTP administration interface for unauthenticated access or unusual PUT operations. Inspect logs for mismatched Transfer Engine endpoints or memory ranges. Use network monitoring to detect unexpected client-server communications.

Impact Analysis

An attacker could overwrite a victim's memory with malicious data, causing incorrect model outputs or service instability in LLM-serving deployments. The attack does not require access to the victim process or configuration changes, making it exploitable remotely.

Compliance Impact

This vulnerability could lead to unauthorized memory corruption in LLM-serving deployments, potentially exposing sensitive data processed by the system. GDPR requires protection of personal data integrity and confidentiality, while HIPAA mandates safeguards for protected health information. The lack of access controls and validation in this flaw may violate these standards by enabling data tampering or unauthorized access.

Mitigation Strategies

Immediately authenticate Store clients and bind Transfer Engine endpoints to authenticated clients. Validate all address ranges before processing segment registrations. Secure the Master's administration HTTP endpoints with authentication and encryption. Update to a patched version if available or apply vendor-recommended fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96763. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart