HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-96762 — A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1....

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosur

Analysis

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 7.3. Published: 2026-09-24T00:17:23.353.

Indicators of Compromise (1)

CVE (1)
CVE-2026-96762
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 24, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Sibos 2026: The quantum tipping point

What does the quantum threat mean for financial services?

Finextra
CRITICALVulnerability

CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a new critical vulnerability in MikroTik RouterOS that could lead to remote code execution or cause a denial-of-service condition. [...]

BleepingComputer
CRITICALVulnerability

Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

Attackers are exploiting a critical flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. CVE-2026-76504 carries a

CVE-2026-76504
The Hacker News