Unauthenticated Metadata Access in Mooncake

Executive Summary

CVE-2026-103765 is a missing authentication vulnerability in Mooncake's HTTP metadata server through version 0.3.13.post1. The /metadata endpoint lacks authentication, allowing unauthenticated attackers to read, overwrite, or delete transfer engine metadata keys. Attackers can poison segment descriptors like tcp_data_port or recreate rpc_meta entries to redirect KV cache transfers to malicious listeners or cause memory exhaustion.

Useful 0 Not Useful 0

Detection Guidance

Check if the Mooncake HTTP metadata server is running on your network by scanning for open ports typically used by the service. Inspect network traffic for unauthenticated GET, PUT, or DELETE requests to the /metadata endpoint. Look for unusual RPC metadata modifications or segment descriptor poisoning attempts in logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read sensitive metadata, redirect data transfers to attacker-controlled systems, overwrite or delete critical metadata, and cause server memory exhaustion. It could lead to data exfiltration, service disruption, or unauthorized access to cached data without detection.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and integrity. It enables unauthorized access to sensitive data (GDPR Article 32, HIPAA Security Rule), allows data exfiltration without detection, and could result in unauthorized modifications to critical system metadata, undermining audit controls and data integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable the HTTP metadata server if not critical. Implement network-level access controls to restrict access to the /metadata endpoint. Monitor for unauthorized modifications to metadata keys and segment descriptors. Consider patching once available or migrating to a secure alternative.

Useful 0 Not Useful 0