CVE-2026-106037

Summary

The flaw is a missing authentication vulnerability in the Store REST service of Mooncake, allowing unauthenticated attackers to read, inject, or delete objects, and mount attacker-described segments. This vulnerability is critical as it can lead to unauthorized access and manipulation of sensitive data.

Exploitability

Exploitation is relatively straightforward as the service binds to 0.0.0.0 without authentication, requiring only network access to the affected endpoints.

Blast radius

If exploited, the impact could be severe, including data leakage, unauthorized modifications, and potential system compromise, affecting any application or service that relies on the Store REST service.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Mooncake 0.3.13.post2 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.