Yyymk

**Name of the Vulnerable Software and Affected Versions** kvcache-ai mooncake versions 0.3.12 through 0.3.14-rc1 **Description** Improper access controls exist within the MountSegment Request Processing component, specifically affecting the `ScopedSegmentAccess::MountSegment()` function in the `segment.cpp` file. This flaw allows a remote attacker to perform manipulations that bypass intended access restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `ScopedSegmentAccess::MountSegment()` function.

**Name of the Vulnerable Software and Affected Versions** kvcache-ai mooncake versions 0.3.12 through 0.3.14-rc1 **Description** A weakness in the Regular Expression Handler component allows a remote attacker to perform a manipulation that leads to the allocation of resources. This issue specifically impacts the `MasterService::GetReplicaListByRegex()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `MasterService::GetReplicaListByRegex()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** kvcache-ai mooncake versions 0.3.12 through 0.3.13.post1 **Description** An authorization bypass exists in the RPC Path Handler component. By manipulating the `client id` or `segment id` arguments within the `UnmountSegment()` function, a remote attacker can bypass authorization mechanisms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `UnmountSegment()` function within the RPC Path Handler.