CVE-2026-106038

Summary

The Mooncake Store application has a critical authentication bypass flaw that allows unauthenticated attackers to completely wipe the cache store by forcing deletion of any objects, potentially causing widespread service disruption and data loss.

Exploitability

Exploitation is straightforward requiring only network access to the coro_rpc port with no authentication prerequisites, making it highly practical for attackers to execute.

Blast radius

If exploited, this vulnerability could cause complete cache corruption across the system, leading to widespread service failures and potential data unavailability as attackers can remove all cached data or specific key patterns.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the coro_rpc port or implement mandatory authentication for Remove, RemoveByRegex, RemoveAll and BatchRemove operations immediately, as no fixed version is published for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.