CVE-2026-103765

Name of the Vulnerable Software and Affected Versions Mooncake versions prior to 0.3.14

Description The HTTP metadata server contains a missing authentication flaw in the '/metadata' endpoint. This allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Exploitation can lead to the poisoning of segment descriptors, such as tcp data port, or the re-creation of rpc meta entries to redirect KV cache transfers to listeners controlled by the attacker. Additionally, this issue can be used to exhaust server memory.

Recommendations Update Mooncake to version 0.3.14 or later. As a temporary mitigation, restrict access to the '/metadata' endpoint to trusted sources only.