MediumVulnerability
CVE-2026-10814: milvus Grantee ID Hash Handler uses weak hash
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-10814
- Published
- Record updated
- Affected
- github.com/milvus-io/milvus < 0.10.3-0.20260602041816-3d932f1c3e06
- Fixed in
- 0.10.3-0.20260602041816-3d932f1c3e06
- released June 2, 2026, 2 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- <0.1%
Summary
CVE-2026-10814 affects milvus-io milvus up to 2.6.13, specifically the Grantee ID Hash Handler component in internal/metastore/kv/rootcoord/kv_catalog.go. A manipulation leads to use of a weak hash. The attack must be performed locally, its complexity is rated high, and exploitability is considered difficult, but the exploit has been publicly disclosed and may be used.
Mitigation
Applying the patch with identifier 3d932f1c3e065351c4440c27abe1e6479752544d is the recommended action.
Related items
- MediumCVE-2026-122160: myshell-ai AIlice HuggingFace Model Wrapper untrusted model loadingSimilar attack · NVD/CVE Database
- MediumCVE-2026-122159: Edge0-AI Audio8_TTS path traversal via slow_decode_models argumentSimilar attack · NVD/CVE Database
- MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
- HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
- HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database