CVE-2026-96763: kvcache-ai mooncake MountSegment Request Processing segment.cpp access control
A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects kvcache-ai mooncake versions up to 0.3.12, 0.3.13.post1, and 0.3.14-rc1. The affected code is the MountSegment request-processing path in segment.cpp.
Does exploitation require prior access or user interaction?
The reported vector is network-based, with low attack complexity and no required privileges. User interaction is required according to the supplied severity vector.
Is public exploitation material available?
Yes. The exploit has been released publicly and may be used in attacks.
What is the expected impact of a successful attack?
The supplied severity vector indicates no confidentiality impact, with low integrity and availability impact. The reported underlying issue is improper access control.