CVE-2026-96762: Mooncake Auth Bypass Vulnerability

CVE-2026-96762 Overview

CVE-2026-96762 is an authorization bypass vulnerability in kvcache-ai mooncake versions up to 0.3.12 and 0.3.13.post1. The flaw resides in the UnmountSegment function of the RPC Path Handler component. Attackers can manipulate the client_id and segment_id arguments to bypass authorization checks over the network. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-285: Improper Authorization.

Critical Impact
Remote unauthenticated attackers can invoke the UnmountSegment RPC and detach memory segments belonging to other clients, affecting the confidentiality, integrity, and availability of the mooncake KV cache service.

Affected Products

kvcache-ai mooncake 0.3.12
kvcache-ai mooncake 0.3.13.post1
Prior releases up to 0.3.12

Discovery Timeline

2026-09-24 - CVE-2026-96762 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database
2026-10-01 - EPSS score recorded at 0.292% (percentile 19.683)

Technical Details for CVE-2026-96762

Vulnerability Analysis

The vulnerability resides in the UnmountSegment function exposed through the mooncake RPC Path Handler. The handler accepts client_id and segment_id parameters from remote callers and processes unmount requests without validating that the requesting client owns the targeted segment. As a result, any network-reachable actor can submit a crafted RPC payload referencing arbitrary identifiers to force removal of memory segments from the shared cache. Because mooncake underpins distributed key-value caches for large language model inference, unauthorized unmount operations can disrupt tenants sharing the service and cause data loss within in-flight workloads.

Root Cause

The root cause is missing authorization enforcement in the UnmountSegment RPC path. The function trusts caller-supplied identifiers without binding them to an authenticated session or verifying ownership. This matches CWE-285: Improper Authorization, where access control decisions depend on client-supplied values rather than server-side policy.

Attack Vector

Exploitation is remote, requires no authentication, and no user interaction. An attacker with network access to the mooncake RPC endpoint sends an UnmountSegment request supplying a target client_id and segment_id. The handler performs the unmount operation on the targeted segment. A public proof-of-concept is referenced on the GitHub Gist PoC and tracked by VulDB CVE-2026-96762.

No verified exploit code is reproduced here. Refer to the external references above for technical details of the request structure.

Detection Methods for CVE-2026-96762

Indicators of Compromise

Unexpected UnmountSegment RPC calls in mooncake service logs, particularly from source addresses outside the trusted inference cluster.
Mismatches between the client_id presented in RPC requests and the originating network identity or session context.
Sudden drops in cached segment counts, cache misses, or inference latency spikes correlated with RPC activity.

Detection Strategies

Enable verbose RPC logging on the mooncake service and alert on UnmountSegment invocations originating from unauthorized hosts.
Baseline normal segment lifecycle events and flag unmount volumes that exceed historical thresholds per tenant.
Correlate RPC activity with network flow data to identify callers that have not previously interacted with the cache.

Monitoring Recommendations

Forward mooncake service logs and host network telemetry to a centralized analytics platform for cross-source correlation.
Monitor firewall and service mesh traffic to the mooncake RPC port for connections from outside the inference workload subnet.
Track application-layer errors from LLM inference workers that reference missing or detached KV cache segments.

How to Mitigate CVE-2026-96762

Immediate Actions Required

Restrict network access to the mooncake RPC endpoint using firewalls, security groups, or service mesh policies so only trusted inference workers can reach it.
Audit mooncake service logs for prior UnmountSegment calls carrying unexpected client_id or segment_id values.
Terminate exposure of mooncake RPC on public interfaces and bind the listener to internal addresses only.

Patch Information

At the time of publication, the vendor did not respond to disclosure and no fixed version has been identified in the available advisories. Monitor the VulDB entry for CVE-2026-96762 and the upstream kvcache-ai/mooncake repository for a patched release. Until a fix is published, apply the workarounds below.

Workarounds

Place the mooncake RPC endpoint behind a mutual TLS proxy that validates client identity before forwarding requests.
Deploy network policies that permit UnmountSegment traffic only from a defined allowlist of inference node addresses.
If supported by the deployment, run separate mooncake instances per tenant to limit the blast radius of unauthorized unmount operations.

bash

# Configuration example: restrict mooncake RPC to internal subnet with iptables
iptables -A INPUT -p tcp --dport 50051 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 50051 -j DROP