CVE-2026-96763: Mooncake Auth Bypass Vulnerability

CVE-2026-96763 Overview

CVE-2026-96763 is an improper access control vulnerability [CWE-266] affecting kvcache-ai Mooncake versions up to 0.3.12, 0.3.13.post1, and 0.3.14-rc1. The flaw resides in the ScopedSegmentAccess::MountSegment function within segment.cpp, part of the MountSegment Request Processing component. An attacker can manipulate the request processing over the network to bypass access controls on mounted memory segments. Public exploit code has been released, increasing the likelihood of opportunistic attacks. The maintainers did not respond to disclosure attempts, so no coordinated patch timeline is available.

Critical Impact
Remote attackers can abuse the MountSegment request path to achieve limited integrity and availability impact against Mooncake KV cache instances.

Affected Products

kvcache-ai Mooncake 0.3.12
kvcache-ai Mooncake 0.3.13.post1
kvcache-ai Mooncake 0.3.14-rc1

Discovery Timeline

2026-09-24 - CVE-2026-96763 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-96763

Vulnerability Analysis

Mooncake is a disaggregated KV cache store used in large language model inference pipelines. The vulnerable code path handles segment mounting requests that register remote memory regions for shared access. The ScopedSegmentAccess::MountSegment routine in segment.cpp fails to enforce proper authorization checks before completing the mount operation. A remote actor with network reach to the Mooncake service can issue crafted MountSegment requests. The vendor confirmed no response to the researcher, meaning no official fix has been published at disclosure time. User interaction is required for exploitation, which limits the practical attack surface in automated server deployments.

Root Cause

The root cause is an improper privilege management defect [CWE-266] in ScopedSegmentAccess::MountSegment. The function performs the segment mount without validating the caller's authorization scope against the segment being attached. This allows a request to proceed with privileges it should not possess, resulting in weakened isolation between tenants or workloads sharing the KV cache.

Attack Vector

Exploitation occurs over the network against an exposed Mooncake endpoint. The attacker crafts a MountSegment request targeting the vulnerable processing path. Because the authorization check is missing, the request is honored and the segment is mounted. Public proof-of-concept code is available through a GitHub Gist PoC Repository, so attackers do not need to develop original exploit tooling. Refer to the VulDB CVE-2026-96763 Details entry for additional metadata.

Detection Methods for CVE-2026-96763

Indicators of Compromise

Unexpected MountSegment requests originating from IP addresses outside the authorized inference cluster.
Mooncake service logs showing successful segment mounts without a corresponding authenticated session.
Anomalous memory segment registrations tied to KV cache instances that fall outside normal workload patterns.

Detection Strategies

Instrument the Mooncake service to log every invocation of ScopedSegmentAccess::MountSegment with caller identity and segment identifier.
Baseline normal MountSegment traffic volume per source and alert on deviations from that baseline.
Correlate network flow telemetry against the published PoC traffic signature to flag matching request shapes.

Monitoring Recommendations

Continuously monitor Mooncake network listeners for connections from untrusted network segments.
Audit segment inventory on a scheduled basis and reconcile against expected inference workloads.
Forward Mooncake application logs to a centralized analytics pipeline for retention and correlation.

How to Mitigate CVE-2026-96763

Immediate Actions Required

Restrict network access to Mooncake service ports so only trusted inference nodes can issue MountSegment requests.
Place Mooncake instances behind a network policy or service mesh that enforces mutual authentication.
Review recent Mooncake logs for suspicious MountSegment activity consistent with the public PoC.

Patch Information

No vendor patch is available at the time of disclosure. The maintainers of kvcache-ai Mooncake did not respond to the researcher's outreach. Track the upstream repository and the VulDB Vulnerability #409018 entry for updates and candidate fixes.

Workarounds

Deploy Mooncake only within isolated, authenticated network segments where no untrusted peer can reach the service port.
Apply ingress firewall rules or Kubernetes NetworkPolicies that allow MountSegment traffic only from allow-listed workload identities.
Disable or gate the MountSegment endpoint behind an authenticating reverse proxy until an upstream fix is released.

bash

# Configuration example
# Example Kubernetes NetworkPolicy restricting Mooncake MountSegment access
# Replace labels and ports with values from your deployment
# This is a mitigation scaffold, not a vendor-supplied fix