Mooncake Store Through 0.3.13 Post1 Unauthenticated Object Deletion Via Remove Rpcs

Back www.vulncheck.com

Mooncake Store Through 0.3.13 Post1 Unauthenticated Object Deletion Via Remove Rpcs

www.vulncheck.com • October 6, 2026

Share: View original

Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

Mooncake <= 0.3.13.post1

Mooncake <= 0.3.13.post1

CWE-306 Missing Authentication for Critical Function

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mooncake Store Vulnerabilities Lead to Unauthenticated Access Risks The Mooncake Store software versions up to 0.3.13.post1 are affected by two critical vulnerabilities: an unauthenticated object deletion via Remove RPCs and a missing authorization via EvictDiskReplica RPC. Both vulnerabilities are categorized under CWE-306 and CWE-862, respectively. These flaws allow unauthorized users to manipulate critical functions without proper authentication or authorization. The vulnerabilities have been disclosed but no patches have been reported as released yet. The potential impact includes unauthorized data manipulation, which could lead to significant security breaches. As of now, there is no evidence of, but the lack of authentication and authorization mechanisms raises serious concerns for users of the affected versions. Security professionals are advised to monitor for updates and apply patches as soon as they are available. 52

Extracted Entities

CWE Weaknesses (1)

CWE-306 - Missing Authentication For Critical Function

Vulnerabilities (1)

Unauthenticated Object Deletion