Kvcache-ai vulnerabilities

Products

• Mooncake 13
• Ktransformers 2

Newest

• kvcache-ai mooncake Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC CVE-2026-106041 6.9 MediumOctober 6, 2026
• kvcache-ai mooncake Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC CVE-2026-106040 8.8 HighOctober 6, 2026
• kvcache-ai mooncake Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC CVE-2026-106039 6.9 MediumOctober 6, 2026
• kvcache-ai mooncake Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs CVE-2026-106038 8.8 HighOctober 6, 2026
• kvcache-ai mooncake Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service CVE-2026-106037 9.3 CriticalOctober 6, 2026
• kvcache-ai mooncake Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString CVE-2026-104433 8.7 HighOctober 2, 2026
• kvcache-ai mooncake Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server CVE-2026-103765 8.8 HighOctober 1, 2026
• kvcache-ai mooncake Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport CVE-2026-103764 9.3 CriticalOctober 1, 2026
• kvcache-ai mooncake Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue CVE-2026-103761 8.7 HighOctober 1, 2026
• kvcache-ai mooncake Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write CVE-2026-103760 8.2 HighOctober 1, 2026
• kvcache-ai mooncake kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources CVE-2026-96764 5.3 MediumSeptember 24, 2026
• kvcache-ai mooncake kvcache-ai mooncake MountSegment Request Processing segment.cpp access control CVE-2026-96763 5.3 MediumSeptember 24, 2026
• kvcache-ai mooncake kvcache-ai mooncake RPC Path UnmountSegment authorization CVE-2026-96762 6.9 MediumSeptember 23, 2026
• kvcache-ai ktransformers ktransformers Unauthenticated Pickle Deserialization RCE via ZMQ CVE-2026-63767 9.3 CriticalJuly 20, 2026
• kvcache-ai ktransformers KTransformers Unsafe Deserialization RCE via balance_serve CVE-2026-26210 9.3 CriticalApril 23, 2026