CVE-2026-106037

{
  "etk_id": "ETK-2026-775",
  "cve_id": "CVE-2026-106037",
  "display_id": "CVE-2026-106037",
  "ghsa_id": "GHSA-737v-cgc2-fgvf",
  "euvd_id": "EUVD-2026-93400",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authentication in Mooncake Store REST service",
  "summary": "Mooncake through 0.3.13.post1 exposes the Store REST service without access controls when it is reachable over the network. An unauthenticated attacker can read cached KV data and modify, delete, or mount stored content. Exploitation requires network access to the service.",
  "mitigation": "Immediately restrict network access to the Store REST service with firewall, security-group, or network-segmentation rules, allowing only trusted hosts. Monitor for a Mooncake release that corrects the issue and upgrade when one is available.",
  "vendor": "kvcache-ai",
  "product": "Mooncake",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.3.13.post1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Mooncake",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.007,
  "epss_percentile": 0.5251,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 61.130271533333335,
  "t0_at": "2026-10-06T14:03:14.718000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-06T14:03:14.718000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T14:03:14.718000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106037"
    }
  }
}