CVE-2026-106040

Name of the Vulnerable Software and Affected Versions Mooncake Store versions master through 0.3.13.post1

Description A missing authorization issue allows unauthenticated attackers to erase disk replicas of any object. By accessing the coro rpc master port, an attacker can trigger the EvictDiskReplica() and BatchEvictDiskReplica() functions to evict DISK replicas across all tenants. This can result in the permanent deletion of objects if the disk replica was the only remaining copy.

Recommendations Update Mooncake Store to a version later than 0.3.13.post1. As a temporary mitigation, restrict access to the coro rpc master port to authorized networks only.