Milvus-Io Milvus vulnerabilities

CVE-2026-26190 [CRITICAL] CWE-306 CVE-2026-26190: Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2 Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluat

CVE-2025-64513 [CRITICAL] CWE-287 CVE-2025-64513: Milvus is an open-source vector database built for generative AI applications. An unauthenticated at Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the Milvus cluster. This grants the attacker the ability t

CVE-2026-10814 [HIGH] CWE-327 CVE-2026-10814: A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rootcoord/kv_catalog.go of the component Grantee ID Hash Handler. The manipulation leads to use of weak hash. The attack needs to be performed locally. The attack's complexity is rated as high. It is stated that the