PT-2026-106745

CVE-2026-106041

Published

2026-10-06

Updated

2026-10-06

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mooncake Store versions 0.3.13.post1 and earlier

Description A missing authorization issue allows unauthenticated attackers to inject completed LOCAL DISK replicas via the NotifyOffloadSuccess RPC. By mounting a local disk segment with a self-chosen client UUID, an attacker can attach replicas that point to endpoints under their control. This enables the delivery of poisoned disk-tier reads and the simulation of fake key existence.

Recommendations Update Mooncake Store to a version later than 0.3.13.post1.

Exploitability

Exploit

Fix

Impacts

Researchers

Jiajia Liu

Mingkai Yu

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization