Skip to content
Fencer Vulns
critical 9.8

CVE-2026-26190 in the critical feed json

Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

published 2026-02-11 8 mo ago modified 2026-09-08 2 mo ago also BIT-milvus-2026-26190 , EUVD-2026-5932 , GHSA-7ppg-37fh-vcr6 , GO-2026-4481

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
39.3%
EPSS 39.3% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known, plus a Nuclei check

Summary

Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10.

Patch / fix

  • go github.com/milvus-io/milvus 2.5.27, 2.6.10
  • bitnami milvus 2.5.27, 2.6.10
  • milvus milvus 2.5.27, 2.6.10
  • govulncheck-vulndb openSUSE Leap 15.6 0.0.20260226T182644-150000.1.149.1

suse advisories SUSE-SU-2026:0757-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
8 mo ago

Exploit prediction

39.26% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Milvus - Unauthenticated Metrics API Access nuclei detection template
  • github.com https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/milvus-io/milvus
<2.5.27
>=2.6.0, <2.6.10
all versions
2.5.27
2.6.10
bitnami milvus
<2.5.27
>=2.6.0, <2.6.10
2.5.27
2.6.10

Affected products

  • milvus-io milvus

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality
  • CWE-1188 Initialization of a Resource with an Insecure Default
  • CWE-749 Exposed Dangerous Method or Function

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.