CVE-2026-26190

Katalog CVE

CVSS 9.8 · Critical EPSS 4,6%

Kerentanan Missing Authentication for Critical Function pada milvus. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10.

Rincian

Terbit di NVD

13 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

4,6% peluang dieksploitasi; lebih tinggi dari 91,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6 exploit · mitigasi · advisory vendor
• https://github.com/milvus-io/milvus/commit/92b74dd2e286006a83b4a5f07951027b32e718a9 patch
• https://github.com/milvus-io/milvus/releases/tag/v2.5.27 product · release notes
• https://github.com/milvus-io/milvus/releases/tag/v2.6.10 product · release notes