CVE-2026-106041

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...

CVE-2026-106041 Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...

CVE-2026-106041

The Mooncake Store master (versions through 0.3.13.post1 ) is vulnerable to a missing authorization flaw (CWE-862) involving the NotifyOffloadSuccess RPC . This allow unauthenticated attackers to inject completed LOCAL_DISK replicas. Specifically, an attacker can mount a local disk segment using ...