CVE-2025-15453: Milvus deserialization flaw in expr.Exec via HTTP endpoint

Summary

CVE-2025-15453 affects the function expr.Exec in pkg/util/expr/expr.go of the HTTP Endpoint component in milvus up to 2.6.7. Manipulating the code argument leads to deserialization of untrusted data (CWE-502), and remote exploitation is possible. The exploit has been disclosed publicly.

Mitigation

A fix is planned for the next release 2.6.8.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online