Mooncake's metadata server lets anyone redirect AI cache transfers

What happened

Mooncake's HTTP metadata server answers its /metadata handler with no authentication, so anyone who can reach it can read, overwrite and delete transfer-engine metadata, poison segment descriptors such as tcp_data_port and redirect KV-cache transfers to a listener they control. CVE-2026-103765, published on 2 October 2026, scores it CVSS 3.1 9.4 and lists every release through 0.3.13.post1, the current one on PyPI, as affected.

Two denial-of-service records published on 1 October affect the same releases: notify frames of up to 1 MB sent to the handshake RPC port grow memory without limit until the out-of-memory killer ends the engine (CVE-2026-103761, 7.5), and a client that never reads replies stalls the handshake daemon's single listener thread (CVE-2026-103760, 5.9). No fixed release was confirmed for the three as of 2 October. SGLang CVE-2026-102634 of 29 September, which crashes SGLang schedulers through duplicate bootstrap_room values on the Mooncake backend, is on row ai-incident-0098.