CVE-2026-103765: Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcpdataport or re-create rpcmeta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Mooncake deployments through version 0.3.13.post1 are affected where the HTTP metadata server and its /metadata handler are reachable by an attacker. The provided information does not identify any authentication requirement or configuration condition that would limit exposure.
What does an attacker need to exploit the vulnerability?
An attacker needs network access to the HTTP metadata server's /metadata handler. No credentials, user interaction, or other privileges are required.
What can an attacker do after exploiting it?
An attacker can read, overwrite, or delete transfer engine metadata keys. They can poison segment descriptors such as tcp_data_port or recreate rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, and can also exhaust server memory.