CVE-2026-106041: Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replicas pointing at attacker-controlled endpoints to serve poisoned disk-tier reads and fake key existence.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
Mooncake Store master deployments through version 0.3.13.post1 should be considered affected.
What access does an attacker need to exploit this issue?
An attacker can exploit the issue without authentication. The attack is network-reachable and requires no user interaction.
What could an attacker do after exploiting the vulnerable RPC?
An attacker can inject completed LOCAL_DISK replicas by mounting a local disk segment with a chosen client UUID and attaching replicas that point to attacker-controlled endpoints. This can poison disk-tier reads and make keys appear to exist when they do not.