CVE-2026-106037: Critical Missing Authentication in Mooncake Store REST Service

What Happened?

CVE-2026-106037 affects the Mooncake Store REST service, a component associated with key-value cache operations. The vulnerability is described as missing authentication on routes exposed by a service that binds to 0.0.0.0. Any attacker who can reach the service may be able to call Store API endpoints without presenting credentials.

The named routes include:

• /api/get
• /api/put
• /api/remove_all
• /api/mount

Depending on deployment and authorization around the service, an unauthenticated caller could read cached key-value data, including user prompts; inject objects; delete cache contents; or mount attacker-described segments. The practical impact extends beyond information disclosure to cache integrity and service-state manipulation.

What’s the Root Cause?

The root cause is an architectural access-control failure: the Store REST service accepts network connections on all interfaces but does not enforce authentication on its routes. Binding to 0.0.0.0 is not itself a vulnerability when a service has strong authentication and network controls. It becomes high risk when an administrative or data-plane API is unauthenticated.

The NVD-linked source reference identifies the relevant implementation in mooncake_store_service.py, around lines 240–282. The available records do not establish whether the service was intended to be internal-only, whether a reverse proxy was expected to provide authentication, or whether individual routes have different authorization behavior.

Defenders should assume that all listed Store routes are exposed if the process is network reachable.

Technical Notes

The reported exposure pattern is straightforward to test from an approved administrative host. Do not run state-changing requests against production during validation:

# Replace the address and port with the approved Mooncake Store endpoint.
curl -i --max-time 5 http://STORE_HOST:STORE_PORT/api/get
curl -i --max-time 5 http://STORE_HOST:STORE_PORT/api/put

A successful HTTP response, an application-level error, or a route-specific response can confirm that the endpoint is reachable. A connection refusal does not prove that the vulnerability is absent; a firewall, listener configuration, proxy, or nonstandard route may account for the result.

Who Needs to Act?

Teams operating Mooncake from the kvcache-ai/Mooncake project should treat versions through 0.3.13.post1 as affected. The affected component is specifically the Store REST service, not necessarily every Mooncake deployment. Exposure depends on whether that service is running, what address it binds to, and which networks can reach its listening port.

The highest-priority environments are those where the Store service is exposed through:

• A cloud public IP
• A Kubernetes node or load balancer
• A shared corporate network
• An inference-service network containing untrusted workloads
• Tenant-controlled containers
• Automation runners or developer workstations
• Partner networks

Analyst’s Take: Treat network reachability as the first decision point, not the version number alone. No fixed version was identified, so isolating exposed Store services is the defensible immediate action while operators review activity and wait for maintainer confirmation.

No fixed version was identified in the supplied NVD record or the referenced GitHub material. A version newer than 0.3.13.post1 should therefore not be treated as remediated solely because its version number is higher.

For broader incident triage, see this guide to identifying whether an email account has been hacked, particularly if cached prompts or credentials may have been exposed.

Why Is the CVSS Score 9.8?

The assigned base score is 9.8 Critical. The supplied NVD result did not include the CVSS vector string, so the exact component values cannot be independently enumerated. Defenders should not infer the precise values for attack complexity, scope, confidentiality, integrity, or availability from the score alone.

The score is consistent with a remotely reachable service that requires no authentication and supports operations affecting both data confidentiality and integrity. Reading cached prompts supports confidentiality impact, while object injection and deletion support integrity and potentially availability impact.

The practical severity is especially high when the Store service is exposed beyond a tightly controlled internal segment.

Because the vector is unavailable, organizations should preserve the published 9.8 score for prioritization but avoid reconstructing a vector as if it were authoritative. Deployment-specific risk may be lower when strong network isolation prevents untrusted access, but network isolation is a compensating control rather than a correction to the vulnerable implementation.

Has CVE-2026-106037 Been Exploited?

No confirmed in-the-wild exploitation was identified in the supplied NVD or CISA KEV results. CVE-2026-106037 is not listed in the CISA Known Exploited Vulnerabilities catalog. There is no CISA KEV date-added value, due date, required action, or ransomware-campaign designation associated with this lookup.

Public technical material does exist. The NVD references the Mooncake repository, a source-code location, upstream GitHub issue #4476, and a VulnCheck advisory. These references establish public disclosure and technical discussion, but the supplied records do not identify a separately verified exploit repository or confirm successful attacks.

The operational conclusion is: public technical information is available, but confirmed active exploitation is not known from the supplied evidence.

KEV absence does not prove that exploitation is impossible or that no private testing has occurred. Internet-exposed instances should be treated as at risk despite the absence of a confirmed campaign.

How Do I Know If I’m Affected?

Start with asset inventory. Identify Mooncake processes, containers, pods, hosts, and services exposing the Store REST listener. Check whether the listener is bound to 0.0.0.0 or another non-loopback address, and review:

• Cloud security groups
• Kubernetes Services
• Ingress objects
• Host firewalls
• Reverse-proxy routes
• Load balancer rules
• Container and pod network policies

Then review request logs and cache state. Look for unexpected calls to /api/get, /api/put, /api/remove_all, or /api/mount, especially from public IP addresses, user subnets, container networks, or systems that do not normally operate the cache.

The available material does not provide a canonical log format, so field names and timestamps will vary by deployment.

Technical Notes

A generic search across collected application and proxy logs can identify the routes named in the advisory:

grep -REn \
  '(/api/(get|put|remove_all|mount))' \
  /var/log/mooncake /var/log/nginx /var/log/haproxy 2>/dev/null

For JSON logs ingested into jq, adapt the field names to the local schema:

jq -r '
  select(
    (.request_uri? // .path? // "") |
    test("^/api/(get|put|remove_all|mount)")
  ) |
  [(.timestamp // .time // ""), (.remote_addr // .client_ip // ""), (.method // ""), (.request_uri // .path // "")] |
  @tsv
' mooncake-access.jsonl

Also inspect for cache objects that were created, modified, or removed outside expected application workflows. A clean log review does not rule out compromise if logging was disabled, rotated, bypassed by a direct connection, or not enabled on the Store service.

What Should I Do About CVE-2026-106037?

No maintainer-confirmed fixed version was identified in the retrieved NVD record or the two fetched GitHub references. There is no defensible package upgrade command or specific fixed version to provide.

Do not install an arbitrary version newer than 0.3.13.post1 and label it patched without confirmation from the Mooncake maintainers.

1. Isolate the Store Service

Restrict the Store service to the smallest trusted source set, remove public ingress, and bind it to a required private or loopback interface where the deployment supports that change. If the service cannot be safely isolated, stop it after assessing the effect on dependent inference or caching workloads.

2. Review Logs and Cache State

Preserve logs and cache metadata before deleting suspicious data. Investigate unexpected reads, writes, deletions, mounts, and access from untrusted networks.

3. Assess Exposed Data and Secrets

Determine whether cached prompts contained credentials, tokens, personal data, proprietary information, or instructions that could influence downstream inference. Rotate credentials or application secrets that may have been present in cached prompts.

For teams rotating multiple credentials after an incident, a managed password tool such as Try 1Password → may help centralize unique credentials and recovery information.

Technical Notes

A host firewall rule can provide an immediate temporary restriction. Replace the example address and port with the actual Store listener and trusted management subnet:

# Allow only the trusted management or application subnet.
sudo iptables -I INPUT -p tcp --dport STORE_PORT \
  -s TRUSTED_SUBNET -j ACCEPT

# Reject other IPv4 connections to the Store service.
sudo iptables -I INPUT -p tcp --dport STORE_PORT -j REJECT

For a systemd-managed service, first identify the actual unit and its listening socket before changing configuration:

sudo ss -ltnp
sudo systemctl list-units --type=service | grep -i mooncake

If the service supports a documented bind-address setting, configure it according to the project’s current deployment documentation and use a loopback or private address rather than 0.0.0.0. Do not invent an unsupported command-line flag or configuration key.

After any change, verify exposure from both a trusted and an untrusted test network.

Monitor the upstream repository and issue tracker for a confirmed patched release. Once a fixed version is published:

1. Validate it in a staging environment.
2. Confirm the Store routes require the intended authorization.
3. Test that unauthorized requests are rejected.
4. Upgrade using the project’s documented package or deployment method.
5. Continue monitoring for indicators of earlier unauthorized access.

Where Does This Information Come From?

The primary source is the NVD record and its associated references. The Mooncake repository and source-code link provide project context and identify the Store service implementation. GitHub issue #4476 provides upstream discussion related to the reported vulnerability. A VulnCheck advisory is also listed among the references.

The supplied research does not include:

• A maintainer-confirmed remediation release
• A CVSS vector string
• A verified exploit repository
• Confirmation of successful exploitation

Those gaps matter operationally. Teams should track the upstream project for authoritative release information rather than relying on an inferred version or third-party package label.

For additional vulnerability remediation context, review the CVE-2026-10520 security advisory.

References

• Mooncake project repository
• Referenced Store service source code
• Mooncake GitHub issue #4476
• VulnCheck advisory

The evidence supports urgent containment of exposed instances, but not a claim that exploitation is confirmed or that a fixed release is available. Organizations should document their exposure, preserve relevant evidence, and reassess when the project publishes a verified remediation.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.