CVE-2026-106037

Name of the Vulnerable Software and Affected Versions Mooncake versions prior to 0.3.14

Description The Store REST service binds to 0.0.0.0 without authentication on any route. This allows unauthenticated attackers to access the following API endpoints: '/api/get', '/api/put', '/api/remove all', and '/api/mount'. Through these endpoints, an attacker can read cached KV (Key-Value) data, inject or delete objects, and mount segments described by the attacker.

Recommendations Update Mooncake to a version later than 0.3.13.post1.