CVE-2026-106041

Name of the Vulnerable Software and Affected Versions Mooncake Store versions 0.3.13.post1 and earlier

Description A missing authorization issue allows unauthenticated attackers to inject completed LOCAL DISK replicas via the NotifyOffloadSuccess RPC. By mounting a local disk segment with a self-chosen client UUID, an attacker can attach replicas that point to endpoints under their control. This enables the delivery of poisoned disk-tier reads and the simulation of fake key existence.

Recommendations Update Mooncake Store to a version later than 0.3.13.post1.