CVE-2026-106038

Name of the Vulnerable Software and Affected Versions Mooncake Store versions master through 0.3.13.post1

Description A missing authentication issue allows unauthenticated attackers to force-delete objects via the coro rpc port. By sending forged requests with the force flag set, attackers can bypass lease checks and utilize the Remove(), RemoveByRegex(), RemoveAll(), and BatchRemove() functions to wipe keys matching any regex or clear the entire store, resulting in cache loss and request failures.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.