CVE-2026-96762

Name of the Vulnerable Software and Affected Versions kvcache-ai mooncake versions 0.3.12 through 0.3.13.post1

Description An authorization bypass exists in the RPC Path Handler component. By manipulating the client id or segment id arguments within the UnmountSegment() function, a remote attacker can bypass authorization mechanisms.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the UnmountSegment() function within the RPC Path Handler.