Is CVE-2026-103765 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103765 being exploited in the wild.

How severe is CVE-2026-103765?

Critical severity, with a CVSS score of 9.4, published 2 October 2026.

Which products and versions are affected?

Kvcache-Ai Mooncake through 0.3.13.post1.

Is there a fix for CVE-2026-103765?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-103765 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-103765?

Check whether you run Kvcache-Ai Mooncake at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103765: Mooncake missing authentication in HTTP metadata server

CVE-2026-103765 · Severity: critical · CVSS 9.4 · Published 2026-10-02

Mooncake is an LLM serving platform that uses an HTTP metadata server to manage KV cache transfer configuration. The /metadata endpoint lacks authentication checks, allowing attackers to read, modify, or delete critical transfer settings. Exploits can redirect cache transfers to attacker-controlled systems, cause denial of service through memory exhaustion, or poison configuration to intercept sensitive data.

Technologies: Kvcache-Ai Mooncake. Vendors: Kvcache-Ai.

Quick answers

Is CVE-2026-103765 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103765 being exploited in the wild.
How severe is CVE-2026-103765?: Critical severity, with a CVSS score of 9.4, published 2 October 2026.
Which products and versions are affected?: Kvcache-Ai Mooncake through 0.3.13.post1.
Is there a fix for CVE-2026-103765?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103765 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-103765?: Check whether you run Kvcache-Ai Mooncake at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The HTTP metadata server's /metadata handler fails to validate request authentication, exposing operations to read, write, and delete metadata keys without credentials. Attackers can access the metadata handler over the network without authentication to modify segment descriptors (tcp_data_port) or rpc_meta entries, enabling redirection of KV cache transfers to malicious listeners or memory exhaustion attacks.

Affected products

KVCache.AI Mooncake through 0.3.13.post1

Timeline

2026-10-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.