Is CVE-2026-106041 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106041 being exploited in the wild.

How severe is CVE-2026-106041?

Medium severity, with a CVSS score of 6.5, published 6 October 2026.

Which products and versions are affected?

Kvcache-Ai Mooncake Store master through 0.3.13.post1.

Is there a fix for CVE-2026-106041?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-106041 attacked?

It is attacked over the network.

Am I affected by CVE-2026-106041?

Check whether you run Kvcache-Ai Mooncake Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106041: Mooncake Store missing authorization in NotifyOffloadSuccess RPC

CVE-2026-106041 · Severity: medium · CVSS 6.5 · Published 2026-10-06

Mooncake Store is a serving platform for large language model caching and storage. An unauthenticated attacker can exploit a missing authorization check in the NotifyOffloadSuccess RPC to inject malicious disk replicas, allowing them to serve poisoned data or fake key existence to legitimate clients without credentials.

Technologies: Kvcache-Ai Mooncake Store. Vendors: Kvcache-Ai.

Quick answers

Is CVE-2026-106041 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106041 being exploited in the wild.
How severe is CVE-2026-106041?: Medium severity, with a CVSS score of 6.5, published 6 October 2026.
Which products and versions are affected?: Kvcache-Ai Mooncake Store master through 0.3.13.post1.
Is there a fix for CVE-2026-106041?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-106041 attacked?: It is attacked over the network.
Am I affected by CVE-2026-106041?: Check whether you run Kvcache-Ai Mooncake Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The NotifyOffloadSuccess RPC in Mooncake Store master through 0.3.13.post1 fails to validate the caller's authorization before accepting LOCAL_DISK replica registrations. An attacker can mount a local disk segment with an arbitrary client UUID and attach replicas pointing to attacker-controlled endpoints, enabling cache poisoning and data integrity attacks. No authentication or network trust is required.

Affected products

kvcache-ai Mooncake Store master through 0.3.13.post1

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.