NVD HIGH: CVE-2026-106040 — Mooncake Store master through 0.3.13.post1 contains a missing authorization vuln...

Tuesday, October 6, 2026 at 02:17 PM UTC·Source: NIST NVD

Updated: Tuesday, October 6, 2026 at 07:00 PM UTC

Executive Summary

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-106040

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 6, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Pepkor's $1.3bn fintech deal comes under shareholder scrutiny

South African retailer Pepkor is facing complaints from directors and investors over a deal to merge its fintech arm with a rival company.

1h agoFinextra

MEDIUMVulnerability

Net Closes Around ShinyHunters with Another FBI Arrest

The FBI has arrested a Canadian cybersecurity executive as it continues its crackdown on ShinyHunters

1h agoInfosecurity Magazine

CRITICALVulnerability

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

CVE-2026-85097

2h agoThe Hacker News