CVE-2026-106039: Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the cororpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No. The vulnerable RPC methods can be invoked by unauthenticated attackers, and no user interaction is required.
What access does an attacker need to exploit this issue?
The attacker needs network access to the Mooncake Store master coro_rpc port. They can obtain victim client UUIDs through QueryTask and use them to target task queues.
What can an attacker do with a disclosed client UUID?
They can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete to create or steal replication tasks, hijack task queues, and mark replication as completed even when it did not occur.