CVE-2026-26190

CRITICAL EPSS 97.8%
Published Feb 13, 20264mo ago · Modified Jun 17, 20261w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Feb 13, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
97.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-306 Missing Authentication for Critical Function Authentication

Affected Products 2

VendorProductVersionRange
milvusmilvus* <2.5.27
milvusmilvus*≥2.6.0  –  <2.6.10

References 4

  • github.com https://github.com/milvus-io/milvus/commit/92b74dd2e286006a83b4a5f07951027b32e718a9
    Patch
  • github.com https://github.com/milvus-io/milvus/releases/tag/v2.5.27
    ProductRelease Notes
  • github.com https://github.com/milvus-io/milvus/releases/tag/v2.6.10
    ProductRelease Notes
  • github.com https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6
    ExploitMitigationVendor Advisory

Remediation

  • github.com https://github.com/milvus-io/milvus/commit/92b74dd2e286006a83b4a5f07951027b32e718a9
    Patch