A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be us [truncated]
CVE-2026-26210 is a critical vulnerability in KTransformers, a software package developed by Kvcache Ai. The vulnerability is caused by an unsafe deserialization issue in the balance_serve backend mode, where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. This allows attackers to send a [truncated]
