CriticalVulnerability
CVE-2026-26190: Milvus authentication bypass through debug and REST API endpoints on port 9091
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-26190
- Published
- Record updated
- Affected
- github.com/milvus-io/milvus < 2.5.27, fixed in 2.5.27
- github.com/milvus-io/milvus >= 2.6.0, < 2.6.10, fixed in 2.6.10
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 39.3%
Summary
Milvus versions prior to 2.5.27 and 2.6.10 expose TCP port 9091 by default, enabling authentication bypasses. The /expr debug endpoint uses a weak, predictable default token derived from etcd.rootPath (default: by-dev), allowing arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without authentication, giving unauthenticated access to all business operations, including data manipulation and credential management.
Mitigation
Fixed in 2.5.27 and 2.6.10.
Topics
Related items
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online
- HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSimilar attack · NVD/CVE Database
- HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSimilar attack · NVD/CVE Database
- HighCVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypassSimilar attack · AWS Security Bulletins
- MediumCVE-2026-115292: Kibana Machine Learning authorization bypass exposes analytics job messagesSimilar attack · NVD/CVE Database