CVE-2026-103765

{
  "etk_id": "ETK-2026-291",
  "cve_id": "CVE-2026-103765",
  "display_id": "CVE-2026-103765",
  "ghsa_id": "GHSA-3mpp-98wg-qvr5",
  "euvd_id": "EUVD-2026-91137",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authentication in Mooncake metadata service",
  "summary": "Mooncake through 0.3.13.post1 exposes its HTTP metadata service without authentication. An attacker able to reach that service can read, alter, or remove transfer metadata, potentially redirecting cache traffic or causing memory exhaustion.",
  "mitigation": "Restrict access to the HTTP metadata service to trusted hosts and networks immediately, such as with firewall rules or an authenticated reverse proxy. Monitor for a Mooncake release that addresses the issue; no fixed version is recorded.",
  "vendor": "kvcache-ai",
  "product": "Mooncake",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.3.13.post1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Mooncake",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.005,
  "epss_percentile": 0.4161,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 52.4390045,
  "t0_at": "2026-10-01T23:19:58.492000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T23:19:58.492000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T23:19:58.492000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103765"
    }
  }
}